commit: a7f4533fcfbb312026bec480f15e94908c64f830 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Jun 19 16:42:53 2015 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Jun 19 16:42:53 2015 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a7f4533f
Linux patch 3.12.44 0000_README | 4 + 1043_linux-3.12.44.patch | 3585 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3589 insertions(+) diff --git a/0000_README b/0000_README index fdf9c8c..c9dc433 100644 --- a/0000_README +++ b/0000_README @@ -214,6 +214,10 @@ Patch: 1042_linux-3.12.43.patch From: http://www.kernel.org Desc: Linux 3.12.43 +Patch: 1043_linux-3.12.44.patch +From: http://www.kernel.org +Desc: Linux 3.12.44 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1043_linux-3.12.44.patch b/1043_linux-3.12.44.patch new file mode 100644 index 0000000..4ff4c57 --- /dev/null +++ b/1043_linux-3.12.44.patch @@ -0,0 +1,3585 @@ +diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp +index 4dfdc8f83633..254d2f55345a 100644 +--- a/Documentation/hwmon/k10temp ++++ b/Documentation/hwmon/k10temp +@@ -11,8 +11,8 @@ Supported chips: + Socket S1G2: Athlon (X2), Sempron (X2), Turion X2 (Ultra) + * AMD Family 12h processors: "Llano" (E2/A4/A6/A8-Series) + * AMD Family 14h processors: "Brazos" (C/E/G/Z-Series) +-* AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity" +-* AMD Family 16h processors: "Kabini" ++* AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity", "Kaveri", "Carrizo" ++* AMD Family 16h processors: "Kabini", "Mullins" + + Prefix: 'k10temp' + Addresses scanned: PCI space +@@ -46,7 +46,7 @@ Description + ----------- + + This driver permits reading of the internal temperature sensor of AMD +-Family 10h/11h/12h/14h/15h processors. ++Family 10h/11h/12h/14h/15h/16h processors. + + All these processors have a sensor, but on those for Socket F or AM2+, + the sensor may return inconsistent values (erratum 319). The driver +diff --git a/Makefile b/Makefile +index baf73c808c04..1ea43665224f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 43 ++SUBLEVEL = 44 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +@@ -241,7 +241,7 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ + + HOSTCC = gcc + HOSTCXX = g++ +-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer ++HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu89 + HOSTCXXFLAGS = -O2 + + # Decide whether to build built-in, modular, or both. +@@ -373,7 +373,9 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ + -fno-strict-aliasing -fno-common \ + -Werror-implicit-function-declaration \ + -Wno-format-security \ +- -fno-delete-null-pointer-checks ++ -fno-delete-null-pointer-checks \ ++ -std=gnu89 ++ + KBUILD_AFLAGS_KERNEL := + KBUILD_CFLAGS_KERNEL := + KBUILD_AFLAGS := -D__ASSEMBLY__ +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index c07aea4f66cb..157e19066449 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -427,7 +427,7 @@ + + fec: ethernet@1002b000 { + compatible = "fsl,imx27-fec"; +- reg = <0x1002b000 0x4000>; ++ reg = <0x1002b000 0x1000>; + interrupts = <50>; + clocks = <&clks 48>, <&clks 67>; + clock-names = "ipg", "ahb"; +diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S +index bc6bd9683ba4..c70b4e195d2e 100644 +--- a/arch/arm/kernel/entry-common.S ++++ b/arch/arm/kernel/entry-common.S +@@ -32,7 +32,9 @@ ret_fast_syscall: + UNWIND(.fnstart ) + UNWIND(.cantunwind ) + disable_irq @ disable interrupts +- ldr r1, [tsk, #TI_FLAGS] ++ ldr r1, [tsk, #TI_FLAGS] @ re-check for syscall tracing ++ tst r1, #_TIF_SYSCALL_WORK ++ bne __sys_trace_return + tst r1, #_TIF_WORK_MASK + bne fast_work_pending + asm_trace_hardirqs_on +diff --git a/arch/m68k/mac/oss.c b/arch/m68k/mac/oss.c +index 6c4c882c126e..f32a8817cc79 100644 +--- a/arch/m68k/mac/oss.c ++++ b/arch/m68k/mac/oss.c +@@ -48,9 +48,8 @@ void __init oss_init(void) + /* Disable all interrupts. Unlike a VIA it looks like we */ + /* do this by setting the source's interrupt level to zero. */ + +- for (i = 0; i <= OSS_NUM_SOURCES; i++) { ++ for (i = 0; i < OSS_NUM_SOURCES; i++) + oss->irq_level[i] = 0; +- } + } + + /* +diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c +index e75ef8219caf..c76f297b7149 100644 +--- a/arch/mips/kvm/kvm_mips_emul.c ++++ b/arch/mips/kvm/kvm_mips_emul.c +@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run) + if (vcpu->mmio_needed == 2) + *gpr = *(int16_t *) run->mmio.data; + else +- *gpr = *(int16_t *) run->mmio.data; ++ *gpr = *(uint16_t *)run->mmio.data; + + break; + case 1: +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index f096e72262f4..1db685104ffc 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -213,6 +213,7 @@ SECTIONS + *(.opd) + } + ++ . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; + #ifndef CONFIG_RELOCATABLE +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index 7ce9cf3b6988..b0c75cc15efc 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -408,7 +408,7 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len, + if (fixed && (addr & ((1ul << pshift) - 1))) + return -EINVAL; + if (fixed && addr > (mm->task_size - len)) +- return -EINVAL; ++ return -ENOMEM; + + /* If hint, make sure it matches our alignment restrictions */ + if (!fixed && addr) { +diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c +index 7940dc90e80b..b258110da952 100644 +--- a/arch/s390/crypto/ghash_s390.c ++++ b/arch/s390/crypto/ghash_s390.c +@@ -16,11 +16,12 @@ + #define GHASH_DIGEST_SIZE 16 + + struct ghash_ctx { +- u8 icv[16]; +- u8 key[16]; ++ u8 key[GHASH_BLOCK_SIZE]; + }; + + struct ghash_desc_ctx { ++ u8 icv[GHASH_BLOCK_SIZE]; ++ u8 key[GHASH_BLOCK_SIZE]; + u8 buffer[GHASH_BLOCK_SIZE]; + u32 bytes; + }; +@@ -28,8 +29,10 @@ struct ghash_desc_ctx { + static int ghash_init(struct shash_desc *desc) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + + memset(dctx, 0, sizeof(*dctx)); ++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm, + } + + memcpy(ctx->key, key, GHASH_BLOCK_SIZE); +- memset(ctx->icv, 0, GHASH_BLOCK_SIZE); + + return 0; + } +@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc, + const u8 *src, unsigned int srclen) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + unsigned int n; + u8 *buf = dctx->buffer; + int ret; +@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc, + src += n; + + if (!dctx->bytes) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, + GHASH_BLOCK_SIZE); + if (ret != GHASH_BLOCK_SIZE) + return -EIO; +@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc, + + n = srclen & ~(GHASH_BLOCK_SIZE - 1); + if (n) { +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n); + if (ret != n) + return -EIO; + src += n; +@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc, + return 0; + } + +-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) ++static int ghash_flush(struct ghash_desc_ctx *dctx) + { + u8 *buf = dctx->buffer; + int ret; +@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx) + + memset(pos, 0, dctx->bytes); + +- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE); ++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE); + if (ret != GHASH_BLOCK_SIZE) + return -EIO; ++ ++ dctx->bytes = 0; + } + +- dctx->bytes = 0; + return 0; + } + + static int ghash_final(struct shash_desc *desc, u8 *dst) + { + struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); +- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm); + int ret; + +- ret = ghash_flush(ctx, dctx); ++ ret = ghash_flush(dctx); + if (!ret) +- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE); ++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE); + return ret; + } + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 5b5c6ea1a76c..0cda30450825 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -156,7 +156,7 @@ config SBUS + + config NEED_DMA_MAP_STATE + def_bool y +- depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG ++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB + + config NEED_SG_DMA_LENGTH + def_bool y +diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h +index 8249df45d2f2..348d9ac94d4e 100644 +--- a/arch/x86/include/asm/perf_event.h ++++ b/arch/x86/include/asm/perf_event.h +@@ -169,6 +169,9 @@ struct x86_pmu_capability { + #define IBS_CAPS_BRNTRGT (1U<<5) + #define IBS_CAPS_OPCNTEXT (1U<<6) + #define IBS_CAPS_RIPINVALIDCHK (1U<<7) ++#define IBS_CAPS_OPBRNFUSE (1U<<8) ++#define IBS_CAPS_FETCHCTLEXTD (1U<<9) ++#define IBS_CAPS_OPDATA4 (1U<<10) + + #define IBS_CAPS_DEFAULT (IBS_CAPS_AVAIL \ + | IBS_CAPS_FETCHSAM \ +diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h +index 228d95f6592a..dbb591390b9e 100644 +--- a/arch/x86/include/uapi/asm/msr-index.h ++++ b/arch/x86/include/uapi/asm/msr-index.h +@@ -201,6 +201,7 @@ + #define MSR_AMD64_IBSOP_REG_MASK ((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1) + #define MSR_AMD64_IBSCTL 0xc001103a + #define MSR_AMD64_IBSBRTARGET 0xc001103b ++#define MSR_AMD64_IBSOPDATA4 0xc001103d + #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */ + + /* Fam 16h MSRs */ +diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c +index 59554dca96ec..6523534671b6 100644 +--- a/arch/x86/kernel/amd_nb.c ++++ b/arch/x86/kernel/amd_nb.c +@@ -22,6 +22,7 @@ const struct pci_device_id amd_nb_misc_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) }, + {} + }; + EXPORT_SYMBOL(amd_nb_misc_ids); +@@ -30,6 +31,7 @@ static const struct pci_device_id amd_nb_link_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) }, + {} + }; + +diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c +index 4b8e4d3cd6ea..6a4b5456240a 100644 +--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c ++++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c +@@ -565,6 +565,21 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) + perf_ibs->offset_max, + offset + 1); + } while (offset < offset_max); ++ if (event->attr.sample_type & PERF_SAMPLE_RAW) { ++ /* ++ * Read IbsBrTarget and IbsOpData4 separately ++ * depending on their availability. ++ * Can't add to offset_max as they are staggered ++ */ ++ if (ibs_caps & IBS_CAPS_BRNTRGT) { ++ rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++); ++ size++; ++ } ++ if (ibs_caps & IBS_CAPS_OPDATA4) { ++ rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++); ++ size++; ++ } ++ } + ibs_data.size = sizeof(u64) * size; + + regs = *iregs; +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 8ad01b4e60cc..b759853d78fe 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -4123,7 +4123,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + ++vcpu->kvm->stat.mmu_pte_write; + kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); + +- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1; ++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1; + for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn) { + if (detect_write_misaligned(sp, gpa, bytes) || + detect_write_flooding(sp)) { +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 4ed75dd81d05..1b72000b6be2 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -211,7 +211,12 @@ void bpf_jit_compile(struct sk_filter *fp) + } + cleanup_addr = proglen; /* epilogue address */ + +- for (pass = 0; pass < 10; pass++) { ++ /* JITed image shrinks with every pass and the loop iterates ++ * until the image stops shrinking. Very large bpf programs ++ * may converge on the last pass. In such case do one more ++ * pass to emit the final image ++ */ ++ for (pass = 0; pass < 10 || image; pass++) { + u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen; + /* no prologue/epilogue for trivial filters (RET something) */ + proglen = 0; +diff --git a/crypto/ansi_cprng.c b/crypto/ansi_cprng.c +index 6f5bebc9bf01..765fe7609348 100644 +--- a/crypto/ansi_cprng.c ++++ b/crypto/ansi_cprng.c +@@ -210,7 +210,11 @@ static int get_prng_bytes(char *buf, size_t nbytes, struct prng_context *ctx, + byte_count = DEFAULT_BLK_SZ; + } + +- err = byte_count; ++ /* ++ * Return 0 in case of success as mandated by the kernel ++ * crypto API interface definition. ++ */ ++ err = 0; + + dbgprint(KERN_CRIT "getting %d random bytes for context %p\n", + byte_count, ctx); +diff --git a/crypto/testmgr.c b/crypto/testmgr.c +index 93e508c39e3b..779a12dcb6a8 100644 +--- a/crypto/testmgr.c ++++ b/crypto/testmgr.c +@@ -1460,11 +1460,11 @@ static int test_cprng(struct crypto_rng *tfm, struct cprng_testvec *template, + for (j = 0; j < template[i].loops; j++) { + err = crypto_rng_get_bytes(tfm, result, + template[i].rlen); +- if (err != template[i].rlen) { ++ if (err < 0) { + printk(KERN_ERR "alg: cprng: Failed to obtain " + "the correct amount of random data for " +- "%s (requested %d, got %d)\n", algo, +- template[i].rlen, err); ++ "%s (requested %d)\n", algo, ++ template[i].rlen); + goto out; + } + } +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index ebe0ea2dff69..91f850585960 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -177,7 +177,7 @@ static void __init acpi_request_region (struct acpi_generic_address *gas, + request_mem_region(addr, length, desc); + } + +-static int __init acpi_reserve_resources(void) ++static void __init acpi_reserve_resources(void) + { + acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length, + "ACPI PM1a_EVT_BLK"); +@@ -206,10 +206,7 @@ static int __init acpi_reserve_resources(void) + if (!(acpi_gbl_FADT.gpe1_block_length & 0x1)) + acpi_request_region(&acpi_gbl_FADT.xgpe1_block, + acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK"); +- +- return 0; + } +-device_initcall(acpi_reserve_resources); + + void acpi_os_printf(const char *fmt, ...) + { +@@ -1764,6 +1761,7 @@ acpi_status __init acpi_os_initialize(void) + + acpi_status __init acpi_os_initialize1(void) + { ++ acpi_reserve_resources(); + kacpid_wq = alloc_workqueue("kacpid", 0, 1); + kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1); + kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1); +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index cfb744709726..9764d9c0447e 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -1693,8 +1693,7 @@ static void ahci_handle_port_interrupt(struct ata_port *ap, + if (unlikely(resetting)) + status &= ~PORT_IRQ_BAD_PMP; + +- /* if LPM is enabled, PHYRDY doesn't mean anything */ +- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) { ++ if (sata_lpm_ignore_phy_events(&ap->link)) { + status &= ~PORT_IRQ_PHYRDY; + ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index a428f6c7aa7c..25dc7cdad863 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4225,10 +4225,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT???M500SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, +- { "Samsung SSD 850 PRO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM, }, ++ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, }, + + /* + * Some WD SATA-I drives spin up and down erratically when the link +@@ -6827,6 +6828,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val, + return tmp; + } + ++/** ++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored ++ * @link: Link receiving the event ++ * ++ * Test whether the received PHY event has to be ignored or not. ++ * ++ * LOCKING: ++ * None: ++ * ++ * RETURNS: ++ * True if the event has to be ignored. ++ */ ++bool sata_lpm_ignore_phy_events(struct ata_link *link) ++{ ++ unsigned long lpm_timeout = link->last_lpm_change + ++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY); ++ ++ /* if LPM is enabled, PHYRDY doesn't mean anything */ ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) ++ return true; ++ ++ /* ignore the first PHY event after the LPM policy changed ++ * as it is might be spurious ++ */ ++ if ((link->flags & ATA_LFLAG_CHANGED) && ++ time_before(jiffies, lpm_timeout)) ++ return true; ++ ++ return false; ++} ++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events); ++ + /* + * Dummy port_ops + */ +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 370462fa8e01..063036d876b0 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -3481,6 +3481,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy, + } + } + ++ link->last_lpm_change = jiffies; ++ link->flags |= ATA_LFLAG_CHANGED; ++ + return 0; + + fail: +diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c +index a36749f1e44a..fb1bad083aa9 100644 +--- a/drivers/connector/connector.c ++++ b/drivers/connector/connector.c +@@ -122,12 +122,18 @@ EXPORT_SYMBOL_GPL(cn_netlink_send); + */ + static int cn_call_callback(struct sk_buff *skb) + { ++ struct nlmsghdr *nlh; + struct cn_callback_entry *i, *cbq = NULL; + struct cn_dev *dev = &cdev; + struct cn_msg *msg = nlmsg_data(nlmsg_hdr(skb)); + struct netlink_skb_parms *nsp = &NETLINK_CB(skb); + int err = -ENODEV; + ++ /* verify msg->len is within skb */ ++ nlh = nlmsg_hdr(skb); ++ if (nlh->nlmsg_len < NLMSG_HDRLEN + sizeof(struct cn_msg) + msg->len) ++ return -EINVAL; ++ + spin_lock_bh(&dev->cbdev->queue_lock); + list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) { + if (cn_cb_equal(&i->id.id, &msg->id)) { +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index 10162af430c5..7a7d5d5d7d6d 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -1806,6 +1806,17 @@ static struct amd64_family_type amd64_family_types[] = { + .read_dct_pci_cfg = f10_read_dct_pci_cfg, + } + }, ++ [F16_M30H_CPUS] = { ++ .ctl_name = "F16h_M30h", ++ .f1_id = PCI_DEVICE_ID_AMD_16H_M30H_NB_F1, ++ .f3_id = PCI_DEVICE_ID_AMD_16H_M30H_NB_F3, ++ .ops = { ++ .early_channel_count = f1x_early_channel_count, ++ .map_sysaddr_to_csrow = f1x_map_sysaddr_to_csrow, ++ .dbam_to_cs = f16_dbam_to_chip_select, ++ .read_dct_pci_cfg = f10_read_dct_pci_cfg, ++ } ++ }, + }; + + /* +@@ -2596,6 +2607,11 @@ static struct amd64_family_type *amd64_per_family_init(struct amd64_pvt *pvt) + break; + + case 0x16: ++ if (pvt->model == 0x30) { ++ fam_type = &amd64_family_types[F16_M30H_CPUS]; ++ pvt->ops = &amd64_family_types[F16_M30H_CPUS].ops; ++ break; ++ } + fam_type = &amd64_family_types[F16_CPUS]; + pvt->ops = &amd64_family_types[F16_CPUS].ops; + break; +@@ -2848,6 +2864,14 @@ static DEFINE_PCI_DEVICE_TABLE(amd64_pci_table) = { + .class = 0, + .class_mask = 0, + }, ++ { ++ .vendor = PCI_VENDOR_ID_AMD, ++ .device = PCI_DEVICE_ID_AMD_16H_M30H_NB_F2, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .class = 0, ++ .class_mask = 0, ++ }, + + {0, } + }; +diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h +index d2443cfa0698..eff9eed80353 100644 +--- a/drivers/edac/amd64_edac.h ++++ b/drivers/edac/amd64_edac.h +@@ -176,6 +176,8 @@ + #define PCI_DEVICE_ID_AMD_15H_NB_F2 0x1602 + #define PCI_DEVICE_ID_AMD_16H_NB_F1 0x1531 + #define PCI_DEVICE_ID_AMD_16H_NB_F2 0x1532 ++#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F1 0x1581 ++#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F2 0x1582 + + /* + * Function 1 - Address Map +@@ -308,6 +310,7 @@ enum amd_families { + F15_CPUS, + F15_M30H_CPUS, + F16_CPUS, ++ F16_M30H_CPUS, + NUM_FAMILIES, + }; + +diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c +index e5bdf216effe..66f2ccfa5665 100644 +--- a/drivers/edac/edac_mc_sysfs.c ++++ b/drivers/edac/edac_mc_sysfs.c +@@ -911,7 +911,7 @@ int __init edac_debugfs_init(void) + return 0; + } + +-void __exit edac_debugfs_exit(void) ++void edac_debugfs_exit(void) + { + debugfs_remove(edac_debugfs); + } +@@ -1165,7 +1165,7 @@ int __init edac_mc_sysfs_init(void) + return err; + } + +-void __exit edac_mc_sysfs_exit(void) ++void edac_mc_sysfs_exit(void) + { + device_unregister(mci_pdev); + edac_put_sysfs_subsys(); +diff --git a/drivers/edac/edac_module.c b/drivers/edac/edac_module.c +index a66941fea5a4..afda850b0b95 100644 +--- a/drivers/edac/edac_module.c ++++ b/drivers/edac/edac_module.c +@@ -112,20 +112,23 @@ static int __init edac_init(void) + + err = edac_mc_sysfs_init(); + if (err) +- goto error; ++ goto err_sysfs; + + edac_debugfs_init(); + +- /* Setup/Initialize the workq for this core */ + err = edac_workqueue_setup(); + if (err) { +- edac_printk(KERN_ERR, EDAC_MC, "init WorkQueue failure\n"); +- goto error; ++ edac_printk(KERN_ERR, EDAC_MC, "Failure initializing workqueue\n"); ++ goto err_wq; + } + + return 0; + +-error: ++err_wq: ++ edac_debugfs_exit(); ++ edac_mc_sysfs_exit(); ++ ++err_sysfs: + return err; + } + +diff --git a/drivers/gpio/gpio-kempld.c b/drivers/gpio/gpio-kempld.c +index efdc3924d7df..7717752cb8cf 100644 +--- a/drivers/gpio/gpio-kempld.c ++++ b/drivers/gpio/gpio-kempld.c +@@ -117,7 +117,7 @@ static int kempld_gpio_get_direction(struct gpio_chip *chip, unsigned offset) + = container_of(chip, struct kempld_gpio_data, chip); + struct kempld_device_data *pld = gpio->pld; + +- return kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); ++ return !kempld_gpio_get_bit(pld, KEMPLD_GPIO_DIR_NUM(offset), offset); + } + + static int kempld_gpio_pincount(struct kempld_device_data *pld) +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 836af49da901..1c031878b6ab 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -49,7 +49,7 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data) + * Return false to keep looking, as more than one gpio chip + * could be registered per of-node. + */ +- gg_data->out_gpio = ERR_PTR(ret); ++ gg_data->out_gpio = ret; + return false; + } + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index bb4c6573a525..944301337c58 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -4575,7 +4575,7 @@ static int cik_pcie_gart_enable(struct radeon_device *rdev) + */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + for (i = 1; i < 16; i++) { + if (i < 8) + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), +diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c +index d5f7e8c14b2e..7dcf2ffddccf 100644 +--- a/drivers/gpu/drm/radeon/ni.c ++++ b/drivers/gpu/drm/radeon/ni.c +@@ -1260,7 +1260,8 @@ static int cayman_pcie_gart_enable(struct radeon_device *rdev) + */ + for (i = 1; i < 8; i++) { + WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0); +- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), ++ rdev->vm_manager.max_pfn - 1); + WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2), + rdev->gart.table_addr >> 12); + } +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index c9f229f2048a..7dcd3c81f42a 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -3976,7 +3976,7 @@ static int si_pcie_gart_enable(struct radeon_device *rdev) + /* empty context1-15 */ + /* set vm size, must be a multiple of 4 */ + WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0); +- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn); ++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1); + /* Assign the pt base to something valid for now; the pts used for + * the VMs are determined by the application and setup and assigned + * on the fly in the vm part of radeon_gart.c +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index 8453214ec376..c607d953270c 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -1027,7 +1027,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, + + if (!list->hdev || !list->hdev->debug) { + ret = -EIO; +- break; ++ set_current_state(TASK_RUNNING); ++ goto out; + } + + /* allow O_NONBLOCK from other threads */ +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index dea5e11cf53a..331204f78382 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -296,8 +296,8 @@ config SENSORS_K10TEMP + If you say yes here you get support for the temperature + sensor(s) inside your CPU. Supported are later revisions of + the AMD Family 10h and all revisions of the AMD Family 11h, +- 12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity) and +- 16h (Kabini) microarchitectures. ++ 12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity/Kaveri/Carrizo) ++ and 16h (Kabini/Mullins) microarchitectures. + + This driver can also be built as a module. If so, the module + will be called k10temp. +diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c +index 758774f4454c..d77f2d63a6c9 100644 +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -33,6 +33,9 @@ static bool force; + module_param(force, bool, 0444); + MODULE_PARM_DESC(force, "force loading on processors with erratum 319"); + ++/* Provide lock for writing to NB_SMU_IND_ADDR */ ++static DEFINE_MUTEX(nb_smu_ind_mutex); ++ + /* CPUID function 0x80000001, ebx */ + #define CPUID_PKGTYPE_MASK 0xf0000000 + #define CPUID_PKGTYPE_F 0x00000000 +@@ -51,13 +54,38 @@ MODULE_PARM_DESC(force, "force loading on processors with erratum 319"); + #define REG_NORTHBRIDGE_CAPABILITIES 0xe8 + #define NB_CAP_HTC 0x00000400 + ++/* ++ * For F15h M60h, functionality of REG_REPORTED_TEMPERATURE ++ * has been moved to D0F0xBC_xD820_0CA4 [Reported Temperature ++ * Control] ++ */ ++#define F15H_M60H_REPORTED_TEMP_CTRL_OFFSET 0xd8200ca4 ++#define PCI_DEVICE_ID_AMD_15H_M60H_NB_F3 0x1573 ++ ++static void amd_nb_smu_index_read(struct pci_dev *pdev, unsigned int devfn, ++ int offset, u32 *val) ++{ ++ mutex_lock(&nb_smu_ind_mutex); ++ pci_bus_write_config_dword(pdev->bus, devfn, ++ 0xb8, offset); ++ pci_bus_read_config_dword(pdev->bus, devfn, ++ 0xbc, val); ++ mutex_unlock(&nb_smu_ind_mutex); ++} ++ + static ssize_t show_temp(struct device *dev, + struct device_attribute *attr, char *buf) + { + u32 regval; +- +- pci_read_config_dword(to_pci_dev(dev), +- REG_REPORTED_TEMPERATURE, ®val); ++ struct pci_dev *pdev = to_pci_dev(dev); ++ ++ if (boot_cpu_data.x86 == 0x15 && boot_cpu_data.x86_model == 0x60) { ++ amd_nb_smu_index_read(pdev, PCI_DEVFN(0, 0), ++ F15H_M60H_REPORTED_TEMP_CTRL_OFFSET, ++ ®val); ++ } else { ++ pci_read_config_dword(pdev, REG_REPORTED_TEMPERATURE, ®val); ++ } + return sprintf(buf, "%u\n", (regval >> 21) * 125); + } + +@@ -211,7 +239,9 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = { + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M60H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) }, + {} + }; + MODULE_DEVICE_TABLE(pci, k10temp_id_table); +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index 6eb03ce2cff4..b6d28439f1b9 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -978,6 +978,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, + (*t)->dev_attr.attr.name, tg->base + i); + if ((*t)->s2) { + a2 = &su->u.a2; ++ sysfs_attr_init(&a2->dev_attr.attr); + a2->dev_attr.attr.name = su->name; + a2->nr = (*t)->u.s.nr + i; + a2->index = (*t)->u.s.index; +@@ -988,6 +989,7 @@ nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg, + *attrs = &a2->dev_attr.attr; + } else { + a = &su->u.a1; ++ sysfs_attr_init(&a->dev_attr.attr); + a->dev_attr.attr.name = su->name; + a->index = (*t)->u.index + i; + a->dev_attr.attr.mode = +diff --git a/drivers/hwmon/ntc_thermistor.c b/drivers/hwmon/ntc_thermistor.c +index e76feb86a1d4..3660cb6fc68a 100644 +--- a/drivers/hwmon/ntc_thermistor.c ++++ b/drivers/hwmon/ntc_thermistor.c +@@ -181,8 +181,10 @@ static struct ntc_thermistor_platform_data * + ntc_thermistor_parse_dt(struct platform_device *pdev) + { + struct iio_channel *chan; ++ enum iio_chan_type type; + struct device_node *np = pdev->dev.of_node; + struct ntc_thermistor_platform_data *pdata; ++ int ret; + + if (!np) + return NULL; +@@ -195,6 +197,13 @@ ntc_thermistor_parse_dt(struct platform_device *pdev) + if (IS_ERR(chan)) + return ERR_CAST(chan); + ++ ret = iio_get_channel_type(chan, &type); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ ++ if (type != IIO_VOLTAGE) ++ return ERR_PTR(-EINVAL); ++ + if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv)) + return ERR_PTR(-ENODEV); + if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm)) +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 90c7f97ea0ad..94d8cb9b4981 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -31,12 +31,14 @@ + * - the iForce driver drivers/char/joystick/iforce.c + * - the skeleton-driver drivers/usb/usb-skeleton.c + * - Xbox 360 information http://www.free60.org/wiki/Gamepad ++ * - Xbox One information https://github.com/quantus/xbox-one-controller-protocol + * + * Thanks to: + * - ITO Takayuki for providing essential xpad information on his website + * - Vojtech Pavlik - iforce driver / input subsystem + * - Greg Kroah-Hartman - usb-skeleton driver + * - XBOX Linux project - extra USB id's ++ * - Pekka Pöyry (quantus) - Xbox One controller reverse engineering + * + * TODO: + * - fine tune axes (especially trigger axes) +@@ -96,7 +98,8 @@ + #define XTYPE_XBOX 0 + #define XTYPE_XBOX360 1 + #define XTYPE_XBOX360W 2 +-#define XTYPE_UNKNOWN 3 ++#define XTYPE_XBOXONE 3 ++#define XTYPE_UNKNOWN 4 + + static bool dpad_to_buttons; + module_param(dpad_to_buttons, bool, S_IRUGO); +@@ -122,6 +125,7 @@ static const struct xpad_device { + { 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX }, + { 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", 0, XTYPE_XBOX }, + { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, ++ { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, + { 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, + { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, +@@ -264,10 +268,12 @@ static const signed short xpad_abs_triggers[] = { + -1 + }; + +-/* Xbox 360 has a vendor-specific class, so we cannot match it with only ++/* ++ * Xbox 360 has a vendor-specific class, so we cannot match it with only + * USB_INTERFACE_INFO (also specifically refused by USB subsystem), so we + * match against vendor id as well. Wired Xbox 360 devices have protocol 1, +- * wireless controllers have protocol 129. */ ++ * wireless controllers have protocol 129. ++ */ + #define XPAD_XBOX360_VENDOR_PROTOCOL(vend,pr) \ + .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \ + .idVendor = (vend), \ +@@ -278,9 +284,21 @@ static const signed short xpad_abs_triggers[] = { + { XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \ + { XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) } + ++/* The Xbox One controller uses subclass 71 and protocol 208. */ ++#define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \ ++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \ ++ .idVendor = (vend), \ ++ .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \ ++ .bInterfaceSubClass = 71, \ ++ .bInterfaceProtocol = (pr) ++#define XPAD_XBOXONE_VENDOR(vend) \ ++ { XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) } ++ + static struct usb_device_id xpad_table[] = { + { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */ ++ XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ ++ XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ + XPAD_XBOX360_VENDOR(0x046d), /* Logitech X-Box 360 style controllers */ + XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz X-Box 360 controllers */ + { USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */ +@@ -314,12 +332,10 @@ struct usb_xpad { + struct urb *bulk_out; + unsigned char *bdata; + +-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS) + struct urb *irq_out; /* urb for interrupt out report */ + unsigned char *odata; /* output data */ + dma_addr_t odata_dma; + struct mutex odata_mutex; +-#endif + + #if defined(CONFIG_JOYSTICK_XPAD_LEDS) + struct xpad_led *led; +@@ -506,6 +522,105 @@ static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned cha + xpad360_process_packet(xpad, cmd, &data[4]); + } + ++/* ++ * xpadone_process_buttons ++ * ++ * Process a button update packet from an Xbox one controller. ++ */ ++static void xpadone_process_buttons(struct usb_xpad *xpad, ++ struct input_dev *dev, ++ unsigned char *data) ++{ ++ /* menu/view buttons */ ++ input_report_key(dev, BTN_START, data[4] & 0x04); ++ input_report_key(dev, BTN_SELECT, data[4] & 0x08); ++ ++ /* buttons A,B,X,Y */ ++ input_report_key(dev, BTN_A, data[4] & 0x10); ++ input_report_key(dev, BTN_B, data[4] & 0x20); ++ input_report_key(dev, BTN_X, data[4] & 0x40); ++ input_report_key(dev, BTN_Y, data[4] & 0x80); ++ ++ /* digital pad */ ++ if (xpad->mapping & MAP_DPAD_TO_BUTTONS) { ++ /* dpad as buttons (left, right, up, down) */ ++ input_report_key(dev, BTN_TRIGGER_HAPPY1, data[5] & 0x04); ++ input_report_key(dev, BTN_TRIGGER_HAPPY2, data[5] & 0x08); ++ input_report_key(dev, BTN_TRIGGER_HAPPY3, data[5] & 0x01); ++ input_report_key(dev, BTN_TRIGGER_HAPPY4, data[5] & 0x02); ++ } else { ++ input_report_abs(dev, ABS_HAT0X, ++ !!(data[5] & 0x08) - !!(data[5] & 0x04)); ++ input_report_abs(dev, ABS_HAT0Y, ++ !!(data[5] & 0x02) - !!(data[5] & 0x01)); ++ } ++ ++ /* TL/TR */ ++ input_report_key(dev, BTN_TL, data[5] & 0x10); ++ input_report_key(dev, BTN_TR, data[5] & 0x20); ++ ++ /* stick press left/right */ ++ input_report_key(dev, BTN_THUMBL, data[5] & 0x40); ++ input_report_key(dev, BTN_THUMBR, data[5] & 0x80); ++ ++ if (!(xpad->mapping & MAP_STICKS_TO_NULL)) { ++ /* left stick */ ++ input_report_abs(dev, ABS_X, ++ (__s16) le16_to_cpup((__le16 *)(data + 10))); ++ input_report_abs(dev, ABS_Y, ++ ~(__s16) le16_to_cpup((__le16 *)(data + 12))); ++ ++ /* right stick */ ++ input_report_abs(dev, ABS_RX, ++ (__s16) le16_to_cpup((__le16 *)(data + 14))); ++ input_report_abs(dev, ABS_RY, ++ ~(__s16) le16_to_cpup((__le16 *)(data + 16))); ++ } ++ ++ /* triggers left/right */ ++ if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) { ++ input_report_key(dev, BTN_TL2, ++ (__u16) le16_to_cpup((__le16 *)(data + 6))); ++ input_report_key(dev, BTN_TR2, ++ (__u16) le16_to_cpup((__le16 *)(data + 8))); ++ } else { ++ input_report_abs(dev, ABS_Z, ++ (__u16) le16_to_cpup((__le16 *)(data + 6))); ++ input_report_abs(dev, ABS_RZ, ++ (__u16) le16_to_cpup((__le16 *)(data + 8))); ++ } ++ ++ input_sync(dev); ++} ++ ++/* ++ * xpadone_process_packet ++ * ++ * Completes a request by converting the data into events for the ++ * input subsystem. This version is for the Xbox One controller. ++ * ++ * The report format was gleaned from ++ * https://github.com/kylelemons/xbox/blob/master/xbox.go ++ */ ++ ++static void xpadone_process_packet(struct usb_xpad *xpad, ++ u16 cmd, unsigned char *data) ++{ ++ struct input_dev *dev = xpad->dev; ++ ++ switch (data[0]) { ++ case 0x20: ++ xpadone_process_buttons(xpad, dev, data); ++ break; ++ ++ case 0x07: ++ /* the xbox button has its own special report */ ++ input_report_key(dev, BTN_MODE, data[4] & 0x01); ++ input_sync(dev); ++ break; ++ } ++} ++ + static void xpad_irq_in(struct urb *urb) + { + struct usb_xpad *xpad = urb->context; +@@ -538,6 +653,9 @@ static void xpad_irq_in(struct urb *urb) + case XTYPE_XBOX360W: + xpad360w_process_packet(xpad, 0, xpad->idata); + break; ++ case XTYPE_XBOXONE: ++ xpadone_process_packet(xpad, 0, xpad->idata); ++ break; + default: + xpad_process_packet(xpad, 0, xpad->idata); + } +@@ -571,7 +689,6 @@ static void xpad_bulk_out(struct urb *urb) + } + } + +-#if defined(CONFIG_JOYSTICK_XPAD_FF) || defined(CONFIG_JOYSTICK_XPAD_LEDS) + static void xpad_irq_out(struct urb *urb) + { + struct usb_xpad *xpad = urb->context; +@@ -609,6 +726,7 @@ exit: + static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) + { + struct usb_endpoint_descriptor *ep_irq_out; ++ int ep_irq_out_idx; + int error; + + if (xpad->xtype == XTYPE_UNKNOWN) +@@ -629,7 +747,10 @@ static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) + goto fail2; + } + +- ep_irq_out = &intf->cur_altsetting->endpoint[1].desc; ++ /* Xbox One controller has in/out endpoints swapped. */ ++ ep_irq_out_idx = xpad->xtype == XTYPE_XBOXONE ? 0 : 1; ++ ep_irq_out = &intf->cur_altsetting->endpoint[ep_irq_out_idx].desc; ++ + usb_fill_int_urb(xpad->irq_out, xpad->udev, + usb_sndintpipe(xpad->udev, ep_irq_out->bEndpointAddress), + xpad->odata, XPAD_PKT_LEN, +@@ -657,11 +778,6 @@ static void xpad_deinit_output(struct usb_xpad *xpad) + xpad->odata, xpad->odata_dma); + } + } +-#else +-static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad) { return 0; } +-static void xpad_deinit_output(struct usb_xpad *xpad) {} +-static void xpad_stop_output(struct usb_xpad *xpad) {} +-#endif + + #ifdef CONFIG_JOYSTICK_XPAD_FF + static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect) +@@ -715,6 +831,23 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect + + return usb_submit_urb(xpad->irq_out, GFP_ATOMIC); + ++ case XTYPE_XBOXONE: ++ xpad->odata[0] = 0x09; /* activate rumble */ ++ xpad->odata[1] = 0x08; ++ xpad->odata[2] = 0x00; ++ xpad->odata[3] = 0x08; /* continuous effect */ ++ xpad->odata[4] = 0x00; /* simple rumble mode */ ++ xpad->odata[5] = 0x03; /* L and R actuator only */ ++ xpad->odata[6] = 0x00; /* TODO: LT actuator */ ++ xpad->odata[7] = 0x00; /* TODO: RT actuator */ ++ xpad->odata[8] = strong / 256; /* left actuator */ ++ xpad->odata[9] = weak / 256; /* right actuator */ ++ xpad->odata[10] = 0x80; /* length of pulse */ ++ xpad->odata[11] = 0x00; /* stop period of pulse */ ++ xpad->irq_out->transfer_buffer_length = 12; ++ ++ return usb_submit_urb(xpad->irq_out, GFP_ATOMIC); ++ + default: + dev_dbg(&xpad->dev->dev, + "%s - rumble command sent to unsupported xpad type: %d\n", +@@ -837,6 +970,14 @@ static int xpad_open(struct input_dev *dev) + if (usb_submit_urb(xpad->irq_in, GFP_KERNEL)) + return -EIO; + ++ if (xpad->xtype == XTYPE_XBOXONE) { ++ /* Xbox one controller needs to be initialized. */ ++ xpad->odata[0] = 0x05; ++ xpad->odata[1] = 0x20; ++ xpad->irq_out->transfer_buffer_length = 2; ++ return usb_submit_urb(xpad->irq_out, GFP_KERNEL); ++ } ++ + return 0; + } + +@@ -852,6 +993,7 @@ static void xpad_close(struct input_dev *dev) + + static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) + { ++ struct usb_xpad *xpad = input_get_drvdata(input_dev); + set_bit(abs, input_dev->absbit); + + switch (abs) { +@@ -863,7 +1005,10 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) + break; + case ABS_Z: + case ABS_RZ: /* the triggers (if mapped to axes) */ +- input_set_abs_params(input_dev, abs, 0, 255, 0, 0); ++ if (xpad->xtype == XTYPE_XBOXONE) ++ input_set_abs_params(input_dev, abs, 0, 1023, 0, 0); ++ else ++ input_set_abs_params(input_dev, abs, 0, 255, 0, 0); + break; + case ABS_HAT0X: + case ABS_HAT0Y: /* the d-pad (only if dpad is mapped to axes */ +@@ -878,6 +1023,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + struct usb_xpad *xpad; + struct input_dev *input_dev; + struct usb_endpoint_descriptor *ep_irq_in; ++ int ep_irq_in_idx; + int i, error; + + for (i = 0; xpad_device[i].idVendor; i++) { +@@ -886,6 +1032,16 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + break; + } + ++ if (xpad_device[i].xtype == XTYPE_XBOXONE && ++ intf->cur_altsetting->desc.bInterfaceNumber != 0) { ++ /* ++ * The Xbox One controller lists three interfaces all with the ++ * same interface class, subclass and protocol. Differentiate by ++ * interface number. ++ */ ++ return -ENODEV; ++ } ++ + xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL); + input_dev = input_allocate_device(); + if (!xpad || !input_dev) { +@@ -956,7 +1112,8 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + __set_bit(xpad_common_btn[i], input_dev->keybit); + + /* set up model-specific ones */ +- if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W) { ++ if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W || ++ xpad->xtype == XTYPE_XBOXONE) { + for (i = 0; xpad360_btn[i] >= 0; i++) + __set_bit(xpad360_btn[i], input_dev->keybit); + } else { +@@ -969,7 +1126,7 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + __set_bit(xpad_btn_pad[i], input_dev->keybit); + } else { + for (i = 0; xpad_abs_pad[i] >= 0; i++) +- xpad_set_up_abs(input_dev, xpad_abs_pad[i]); ++ xpad_set_up_abs(input_dev, xpad_abs_pad[i]); + } + + if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) { +@@ -992,7 +1149,10 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id + if (error) + goto fail5; + +- ep_irq_in = &intf->cur_altsetting->endpoint[0].desc; ++ /* Xbox One controller has in/out endpoints swapped. */ ++ ep_irq_in_idx = xpad->xtype == XTYPE_XBOXONE ? 1 : 0; ++ ep_irq_in = &intf->cur_altsetting->endpoint[ep_irq_in_idx].desc; ++ + usb_fill_int_urb(xpad->irq_in, udev, + usb_rcvintpipe(udev, ep_irq_in->bEndpointAddress), + xpad->idata, XPAD_PKT_LEN, xpad_irq_in, +diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c +index 7e8b0a52af25..528de9cdf075 100644 +--- a/drivers/input/keyboard/cros_ec_keyb.c ++++ b/drivers/input/keyboard/cros_ec_keyb.c +@@ -309,7 +309,7 @@ static int cros_ec_keyb_resume(struct device *dev) + * wake source (e.g. the lid is open and the user might press a key to + * wake) then the key scan buffer should be preserved. + */ +- if (ckdev->ec->was_wake_device) ++ if (!ckdev->ec->was_wake_device) + cros_ec_keyb_clear_keyboard(ckdev); + + return 0; +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 04a7d9f00928..71540c0eee44 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -314,7 +314,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev, + unsigned int x2, unsigned int y2) + { + elantech_set_slot(dev, 0, num_fingers != 0, x1, y1); +- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2); ++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2); + } + + /* +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index 5f87bed05467..e565530e3596 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -133,6 +133,7 @@ enum { + DEVTYPE_GUNZE, + DEVTYPE_DMC_TSC10, + DEVTYPE_IRTOUCH, ++ DEVTYPE_IRTOUCH_HIRES, + DEVTYPE_IDEALTEK, + DEVTYPE_GENERAL_TOUCH, + DEVTYPE_GOTOP, +@@ -199,6 +200,7 @@ static const struct usb_device_id usbtouch_devices[] = { + #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH + {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, ++ {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES}, + #endif + + #ifdef CONFIG_TOUCHSCREEN_USB_IDEALTEK +@@ -1178,6 +1180,15 @@ static struct usbtouch_device_info usbtouch_dev_info[] = { + .rept_size = 8, + .read_data = irtouch_read_data, + }, ++ ++ [DEVTYPE_IRTOUCH_HIRES] = { ++ .min_xc = 0x0, ++ .max_xc = 0x7fff, ++ .min_yc = 0x0, ++ .max_yc = 0x7fff, ++ .rept_size = 8, ++ .read_data = irtouch_read_data, ++ }, + #endif + + #ifdef CONFIG_TOUCHSCREEN_USB_IDEALTEK +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 67644e960592..27f9b8d433a3 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1376,7 +1376,9 @@ static u64 *alloc_pte(struct protection_domain *domain, + * This function checks if there is a PTE for a given dma address. If + * there is one, it returns the pointer to it. + */ +-static u64 *fetch_pte(struct protection_domain *domain, unsigned long address) ++static u64 *fetch_pte(struct protection_domain *domain, ++ unsigned long address, ++ unsigned long *page_size) + { + int level; + u64 *pte; +@@ -1384,8 +1386,9 @@ static u64 *fetch_pte(struct protection_domain *domain, unsigned long address) + if (address > PM_LEVEL_SIZE(domain->mode)) + return NULL; + +- level = domain->mode - 1; +- pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)]; ++ level = domain->mode - 1; ++ pte = &domain->pt_root[PM_LEVEL_INDEX(level, address)]; ++ *page_size = PTE_LEVEL_PAGE_SIZE(level); + + while (level > 0) { + +@@ -1394,19 +1397,9 @@ static u64 *fetch_pte(struct protection_domain *domain, unsigned long address) + return NULL; + + /* Large PTE */ +- if (PM_PTE_LEVEL(*pte) == 0x07) { +- unsigned long pte_mask, __pte; +- +- /* +- * If we have a series of large PTEs, make +- * sure to return a pointer to the first one. +- */ +- pte_mask = PTE_PAGE_SIZE(*pte); +- pte_mask = ~((PAGE_SIZE_PTE_COUNT(pte_mask) << 3) - 1); +- __pte = ((unsigned long)pte) & pte_mask; +- +- return (u64 *)__pte; +- } ++ if (PM_PTE_LEVEL(*pte) == 7 || ++ PM_PTE_LEVEL(*pte) == 0) ++ break; + + /* No level skipping support yet */ + if (PM_PTE_LEVEL(*pte) != level) +@@ -1415,8 +1408,21 @@ static u64 *fetch_pte(struct protection_domain *domain, unsigned long address) + level -= 1; + + /* Walk to the next level */ +- pte = IOMMU_PTE_PAGE(*pte); +- pte = &pte[PM_LEVEL_INDEX(level, address)]; ++ pte = IOMMU_PTE_PAGE(*pte); ++ pte = &pte[PM_LEVEL_INDEX(level, address)]; ++ *page_size = PTE_LEVEL_PAGE_SIZE(level); ++ } ++ ++ if (PM_PTE_LEVEL(*pte) == 0x07) { ++ unsigned long pte_mask; ++ ++ /* ++ * If we have a series of large PTEs, make ++ * sure to return a pointer to the first one. ++ */ ++ *page_size = pte_mask = PTE_PAGE_SIZE(*pte); ++ pte_mask = ~((PAGE_SIZE_PTE_COUNT(pte_mask) << 3) - 1); ++ pte = (u64 *)(((unsigned long)pte) & pte_mask); + } + + return pte; +@@ -1438,19 +1444,20 @@ static int iommu_map_page(struct protection_domain *dom, + u64 __pte, *pte; + int i, count; + ++ BUG_ON(!IS_ALIGNED(bus_addr, page_size)); ++ BUG_ON(!IS_ALIGNED(phys_addr, page_size)); ++ + if (!(prot & IOMMU_PROT_MASK)) + return -EINVAL; + +- bus_addr = PAGE_ALIGN(bus_addr); +- phys_addr = PAGE_ALIGN(phys_addr); +- count = PAGE_SIZE_PTE_COUNT(page_size); +- pte = alloc_pte(dom, bus_addr, page_size, NULL, GFP_KERNEL); ++ count = PAGE_SIZE_PTE_COUNT(page_size); ++ pte = alloc_pte(dom, bus_addr, page_size, NULL, GFP_KERNEL); + + for (i = 0; i < count; ++i) + if (IOMMU_PTE_PRESENT(pte[i])) + return -EBUSY; + +- if (page_size > PAGE_SIZE) { ++ if (count > 1) { + __pte = PAGE_SIZE_PTE(phys_addr, page_size); + __pte |= PM_LEVEL_ENC(7) | IOMMU_PTE_P | IOMMU_PTE_FC; + } else +@@ -1473,7 +1480,8 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom, + unsigned long bus_addr, + unsigned long page_size) + { +- unsigned long long unmap_size, unmapped; ++ unsigned long long unmapped; ++ unsigned long unmap_size; + u64 *pte; + + BUG_ON(!is_power_of_2(page_size)); +@@ -1482,28 +1490,12 @@ static unsigned long iommu_unmap_page(struct protection_domain *dom, + + while (unmapped < page_size) { + +- pte = fetch_pte(dom, bus_addr); +- +- if (!pte) { +- /* +- * No PTE for this address +- * move forward in 4kb steps +- */ +- unmap_size = PAGE_SIZE; +- } else if (PM_PTE_LEVEL(*pte) == 0) { +- /* 4kb PTE found for this address */ +- unmap_size = PAGE_SIZE; +- *pte = 0ULL; +- } else { +- int count, i; +- +- /* Large PTE found which maps this address */ +- unmap_size = PTE_PAGE_SIZE(*pte); +- +- /* Only unmap from the first pte in the page */ +- if ((unmap_size - 1) & bus_addr) +- break; +- count = PAGE_SIZE_PTE_COUNT(unmap_size); ++ pte = fetch_pte(dom, bus_addr, &unmap_size); ++ ++ if (pte) { ++ int i, count; ++ ++ count = PAGE_SIZE_PTE_COUNT(unmap_size); + for (i = 0; i < count; i++) + pte[i] = 0ULL; + } +@@ -1651,7 +1643,7 @@ static int alloc_new_range(struct dma_ops_domain *dma_dom, + { + int index = dma_dom->aperture_size >> APERTURE_RANGE_SHIFT; + struct amd_iommu *iommu; +- unsigned long i, old_size; ++ unsigned long i, old_size, pte_pgsize; + + #ifdef CONFIG_IOMMU_STRESS + populate = false; +@@ -1724,12 +1716,13 @@ static int alloc_new_range(struct dma_ops_domain *dma_dom, + */ + for (i = dma_dom->aperture[index]->offset; + i < dma_dom->aperture_size; +- i += PAGE_SIZE) { +- u64 *pte = fetch_pte(&dma_dom->domain, i); ++ i += pte_pgsize) { ++ u64 *pte = fetch_pte(&dma_dom->domain, i, &pte_pgsize); + if (!pte || !IOMMU_PTE_PRESENT(*pte)) + continue; + +- dma_ops_reserve_addresses(dma_dom, i >> PAGE_SHIFT, 1); ++ dma_ops_reserve_addresses(dma_dom, i >> PAGE_SHIFT, ++ pte_pgsize >> 12); + } + + update_domain(&dma_dom->domain); +@@ -3439,27 +3432,21 @@ static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom, + dma_addr_t iova) + { + struct protection_domain *domain = dom->priv; +- unsigned long offset_mask; +- phys_addr_t paddr; ++ unsigned long offset_mask, pte_pgsize; + u64 *pte, __pte; + + if (domain->mode == PAGE_MODE_NONE) + return iova; + +- pte = fetch_pte(domain, iova); ++ pte = fetch_pte(domain, iova, &pte_pgsize); + + if (!pte || !IOMMU_PTE_PRESENT(*pte)) + return 0; + +- if (PM_PTE_LEVEL(*pte) == 0) +- offset_mask = PAGE_SIZE - 1; +- else +- offset_mask = PTE_PAGE_SIZE(*pte) - 1; +- +- __pte = *pte & PM_ADDR_MASK; +- paddr = (__pte & ~offset_mask) | (iova & offset_mask); ++ offset_mask = pte_pgsize - 1; ++ __pte = *pte & PM_ADDR_MASK; + +- return paddr; ++ return (__pte & ~offset_mask) | (iova & offset_mask); + } + + static int amd_iommu_domain_has_cap(struct iommu_domain *domain, +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index e400fbe411de..97e81fe5c330 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -276,6 +276,12 @@ + #define PTE_PAGE_SIZE(pte) \ + (1ULL << (1 + ffz(((pte) | 0xfffULL)))) + ++/* ++ * Takes a page-table level and returns the default page-size for this level ++ */ ++#define PTE_LEVEL_PAGE_SIZE(level) \ ++ (1ULL << (12 + (9 * (level)))) ++ + #define IOMMU_PTE_P (1ULL << 0) + #define IOMMU_PTE_TV (1ULL << 1) + #define IOMMU_PTE_U (1ULL << 59) +diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c +index e74df7c4658f..af1577dd9825 100644 +--- a/drivers/isdn/icn/icn.c ++++ b/drivers/isdn/icn/icn.c +@@ -1611,7 +1611,7 @@ icn_setup(char *line) + if (ints[0] > 1) + membase = (unsigned long)ints[2]; + if (str && *str) { +- strcpy(sid, str); ++ strlcpy(sid, str, sizeof(sid)); + icn_id = sid; + if ((p = strchr(sid, ','))) { + *p++ = 0; +diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c +index 0bf1e4edf04d..19da22249bd8 100644 +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -176,7 +176,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 09c18062bbc2..4881851c4b42 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1812,7 +1812,8 @@ static int resize_stripes(struct r5conf *conf, int newsize) + + conf->slab_cache = sc; + conf->active_name = 1-conf->active_name; +- conf->pool_size = newsize; ++ if (!err) ++ conf->pool_size = newsize; + return err; + } + +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index a0752e9ce977..ebc5cd6518a0 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1301,7 +1301,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + + if (ios->clock) { + unsigned int clock_min = ~0U; +- u32 clkdiv; ++ int clkdiv; + + clk_prepare(host->mck); + unprepare_clk = true; +@@ -1330,7 +1330,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + /* Calculate clock divider */ + if (host->caps.has_odd_clk_div) { + clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2; +- if (clkdiv > 511) { ++ if (clkdiv < 0) { ++ dev_warn(&mmc->class_dev, ++ "clock %u too fast; using %lu\n", ++ clock_min, host->bus_hz / 2); ++ clkdiv = 0; ++ } else if (clkdiv > 511) { + dev_warn(&mmc->class_dev, + "clock %u too slow; using %lu\n", + clock_min, host->bus_hz / (511 + 2)); +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index 7490b6c866e6..d2907a6e3dab 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -45,7 +45,7 @@ + #define PSF_TX 0x1000 + #define EXT_EVENT 1 + #define CAL_EVENT 7 +-#define CAL_TRIGGER 7 ++#define CAL_TRIGGER 1 + #define PER_TRIGGER 6 + + #define MII_DP83640_MICR 0x11 +diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c +index a44862ad84ec..021ed7f0e25f 100644 +--- a/drivers/net/wireless/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/rt2x00/rt2800usb.c +@@ -994,6 +994,7 @@ static struct usb_device_id rt2800usb_device_table[] = { + { USB_DEVICE(0x07d1, 0x3c17) }, + { USB_DEVICE(0x2001, 0x3317) }, + { USB_DEVICE(0x2001, 0x3c1b) }, ++ { USB_DEVICE(0x2001, 0x3c25) }, + /* Draytek */ + { USB_DEVICE(0x07fa, 0x7712) }, + /* DVICO */ +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index 97924743ecf6..832560aa2274 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request, + + do { + status = usb_control_msg(udev, pipe, request, reqtype, value, +- index, pdata, len, 0); /*max. timeout*/ ++ index, pdata, len, 1000); + if (status < 0) { + /* firmware download is checksumed, don't retry */ + if ((value >= FW_8192C_START_ADDRESS && +diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c +index 1b08d8798372..659a6f2abb67 100644 +--- a/drivers/net/xen-netback/xenbus.c ++++ b/drivers/net/xen-netback/xenbus.c +@@ -33,6 +33,8 @@ struct backend_info { + enum xenbus_state frontend_state; + struct xenbus_watch hotplug_status_watch; + u8 have_hotplug_status_watch:1; ++ ++ const char *hotplug_script; + }; + + static int connect_rings(struct backend_info *); +@@ -55,6 +57,7 @@ static int netback_remove(struct xenbus_device *dev) + xenvif_free(be->vif); + be->vif = NULL; + } ++ kfree(be->hotplug_script); + kfree(be); + dev_set_drvdata(&dev->dev, NULL); + return 0; +@@ -72,6 +75,7 @@ static int netback_probe(struct xenbus_device *dev, + struct xenbus_transaction xbt; + int err; + int sg; ++ const char *script; + struct backend_info *be = kzalloc(sizeof(struct backend_info), + GFP_KERNEL); + if (!be) { +@@ -142,6 +146,15 @@ static int netback_probe(struct xenbus_device *dev, + if (err) + pr_debug("Error writing feature-split-event-channels\n"); + ++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL); ++ if (IS_ERR(script)) { ++ err = PTR_ERR(script); ++ xenbus_dev_fatal(dev, err, "reading script"); ++ goto fail; ++ } ++ ++ be->hotplug_script = script; ++ + err = xenbus_switch_state(dev, XenbusStateInitWait); + if (err) + goto fail; +@@ -172,22 +185,14 @@ static int netback_uevent(struct xenbus_device *xdev, + struct kobj_uevent_env *env) + { + struct backend_info *be = dev_get_drvdata(&xdev->dev); +- char *val; + +- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL); +- if (IS_ERR(val)) { +- int err = PTR_ERR(val); +- xenbus_dev_fatal(xdev, err, "reading script"); +- return err; +- } else { +- if (add_uevent_var(env, "script=%s", val)) { +- kfree(val); +- return -ENOMEM; +- } +- kfree(val); +- } ++ if (!be) ++ return 0; ++ ++ if (add_uevent_var(env, "script=%s", be->hotplug_script)) ++ return -ENOMEM; + +- if (!be || !be->vif) ++ if (!be->vif) + return 0; + + return add_uevent_var(env, "vif=%s", be->vif->dev->name); +diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c +index 5df730be88a3..30e50987b8df 100644 +--- a/drivers/nfc/pn533.c ++++ b/drivers/nfc/pn533.c +@@ -2352,8 +2352,10 @@ static int pn533_data_exchange_complete(struct pn533 *dev, void *_arg, + } + + skb = pn533_build_response(dev); +- if (!skb) ++ if (!skb) { ++ rc = -ENOMEM; + goto error; ++ } + + arg->cb(arg->cb_context, skb, 0); + kfree(arg); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index d535e7504ea0..64e15408a354 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -3920,10 +3920,6 @@ static int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) + + /* Save the PCI command register */ + pci_read_config_word(pdev, 4, &command_register); +- /* Turn the board off. This is so that later pci_restore_state() +- * won't turn the board on before the rest of config space is ready. +- */ +- pci_disable_device(pdev); + pci_save_state(pdev); + + /* find the first memory BAR, so we can find the cfg table */ +@@ -3971,11 +3967,6 @@ static int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev) + goto unmap_cfgtable; + + pci_restore_state(pdev); +- rc = pci_enable_device(pdev); +- if (rc) { +- dev_warn(&pdev->dev, "failed to enable device.\n"); +- goto unmap_cfgtable; +- } + pci_write_config_word(pdev, 4, command_register); + + /* Some devices (notably the HP Smart Array 5i Controller) +@@ -4466,10 +4457,37 @@ static void hpsa_hba_inquiry(struct ctlr_info *h) + static int hpsa_init_reset_devices(struct pci_dev *pdev) + { + int rc, i; ++ void __iomem *vaddr; + + if (!reset_devices) + return 0; + ++ /* kdump kernel is loading, we don't know in which state is ++ * the pci interface. The dev->enable_cnt is equal zero ++ * so we call enable+disable, wait a while and switch it on. ++ */ ++ rc = pci_enable_device(pdev); ++ if (rc) { ++ dev_warn(&pdev->dev, "Failed to enable PCI device\n"); ++ return -ENODEV; ++ } ++ pci_disable_device(pdev); ++ msleep(260); /* a randomly chosen number */ ++ rc = pci_enable_device(pdev); ++ if (rc) { ++ dev_warn(&pdev->dev, "failed to enable device.\n"); ++ return -ENODEV; ++ } ++ pci_set_master(pdev); ++ ++ vaddr = pci_ioremap_bar(pdev, 0); ++ if (vaddr == NULL) { ++ rc = -ENOMEM; ++ goto out_disable; ++ } ++ writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET); ++ iounmap(vaddr); ++ + /* Reset the controller with a PCI power-cycle or via doorbell */ + rc = hpsa_kdump_hard_reset_controller(pdev); + +@@ -4478,10 +4496,11 @@ static int hpsa_init_reset_devices(struct pci_dev *pdev) + * "performant mode". Or, it might be 640x, which can't reset + * due to concerns about shared bbwc between 6402/6404 pair. + */ +- if (rc == -ENOTSUPP) +- return rc; /* just try to do the kdump anyhow. */ +- if (rc) +- return -ENODEV; ++ if (rc) { ++ if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */ ++ rc = -ENODEV; ++ goto out_disable; ++ } + + /* Now try to get the controller to respond to a no-op */ + dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n"); +@@ -4492,7 +4511,11 @@ static int hpsa_init_reset_devices(struct pci_dev *pdev) + dev_warn(&pdev->dev, "no-op failed%s\n", + (i < 11 ? "; re-trying" : "")); + } +- return 0; ++ ++out_disable: ++ ++ pci_disable_device(pdev); ++ return rc; + } + + static int hpsa_allocate_cmd_pool(struct ctlr_info *h) +@@ -4635,6 +4658,7 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h) + iounmap(h->transtable); + if (h->cfgtable) + iounmap(h->cfgtable); ++ pci_disable_device(h->pdev); + pci_release_regions(h->pdev); + kfree(h); + } +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 4446bf5fe292..fafb3fa3929f 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -721,8 +721,6 @@ extern void qla8044_set_idc_dontreset(struct scsi_qla_host *ha); + extern int qla8044_rd_direct(struct scsi_qla_host *vha, const uint32_t crb_reg); + extern void qla8044_wr_direct(struct scsi_qla_host *vha, + const uint32_t crb_reg, const uint32_t value); +-extern inline void qla8044_set_qsnt_ready(struct scsi_qla_host *vha); +-extern inline void qla8044_need_reset_handler(struct scsi_qla_host *vha); + extern int qla8044_device_state_handler(struct scsi_qla_host *vha); + extern void qla8044_clear_qsnt_ready(struct scsi_qla_host *vha); + extern void qla8044_clear_drv_active(struct scsi_qla_host *vha); +diff --git a/drivers/scsi/qla2xxx/qla_nx2.c b/drivers/scsi/qla2xxx/qla_nx2.c +index 8164cc9e7286..996f400c20ad 100644 +--- a/drivers/scsi/qla2xxx/qla_nx2.c ++++ b/drivers/scsi/qla2xxx/qla_nx2.c +@@ -146,7 +146,7 @@ qla8044_rmw_crb_reg(struct scsi_qla_host *vha, + return; + } + +-inline void ++static inline void + qla8044_set_qsnt_ready(struct scsi_qla_host *vha) + { + uint32_t qsnt_state; +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 69d2a7060fde..6e361148911f 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1580,6 +1580,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + { + u64 start_lba = blk_rq_pos(scmd->request); + u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512); ++ u64 factor = scmd->device->sector_size / 512; + u64 bad_lba; + int info_valid; + /* +@@ -1601,16 +1602,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd) + if (scsi_bufflen(scmd) <= scmd->device->sector_size) + return 0; + +- if (scmd->device->sector_size < 512) { +- /* only legitimate sector_size here is 256 */ +- start_lba <<= 1; +- end_lba <<= 1; +- } else { +- /* be careful ... don't want any overflows */ +- u64 factor = scmd->device->sector_size / 512; +- do_div(start_lba, factor); +- do_div(end_lba, factor); +- } ++ /* be careful ... don't want any overflows */ ++ do_div(start_lba, factor); ++ do_div(end_lba, factor); + + /* The bad lba was reported incorrectly, we have no idea where + * the error is. +@@ -2177,8 +2171,7 @@ got_data: + if (sector_size != 512 && + sector_size != 1024 && + sector_size != 2048 && +- sector_size != 4096 && +- sector_size != 256) { ++ sector_size != 4096) { + sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n", + sector_size); + /* +@@ -2229,8 +2222,6 @@ got_data: + sdkp->capacity <<= 2; + else if (sector_size == 1024) + sdkp->capacity <<= 1; +- else if (sector_size == 256) +- sdkp->capacity >>= 1; + + blk_queue_physical_block_size(sdp->request_queue, + sdkp->physical_block_size); +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 97892f258043..3bb6646bb406 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1625,8 +1625,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) + break; + default: + vm_srb->data_in = UNKNOWN_TYPE; +- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN | +- SRB_FLAGS_DATA_OUT); ++ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER; + break; + } + +diff --git a/drivers/staging/dgap/Makefile b/drivers/staging/dgap/Makefile +index 9f1fce157c77..3abe8d2bb748 100644 +--- a/drivers/staging/dgap/Makefile ++++ b/drivers/staging/dgap/Makefile +@@ -1,5 +1,3 @@ +-EXTRA_CFLAGS += -DDG_NAME=\"dgap-1.3-16\" -DDG_PART=\"40002347_C\" +- + obj-$(CONFIG_DGAP) += dgap.o + + +diff --git a/drivers/staging/dgap/dgap_driver.h b/drivers/staging/dgap/dgap_driver.h +index b1cf489a729c..1742f4071e4d 100644 +--- a/drivers/staging/dgap/dgap_driver.h ++++ b/drivers/staging/dgap/dgap_driver.h +@@ -53,6 +53,9 @@ + * DPR((fmt, args, ...)); Only prints if DGAP_TRACER is defined at + * compile time and dgap_debug!=0 + */ ++#define DG_NAME "dgap-1.3-16" ++#define DG_PART "40002347_C" ++ + #define PROCSTR "dgap" /* /proc entries */ + #define DEVSTR "/dev/dg/dgap" /* /dev entries */ + #define DRVSTR "dgap" /* Driver name string +diff --git a/drivers/staging/dgnc/Makefile b/drivers/staging/dgnc/Makefile +index 888c4334236b..9e1efcb8dcb7 100644 +--- a/drivers/staging/dgnc/Makefile ++++ b/drivers/staging/dgnc/Makefile +@@ -1,5 +1,3 @@ +-EXTRA_CFLAGS += -DDG_NAME=\"dgnc-1.3-16\" -DDG_PART=\"40002369_F\" +- + obj-$(CONFIG_DGNC) += dgnc.o + + dgnc-objs := dgnc_cls.o dgnc_driver.o\ +diff --git a/drivers/staging/dgnc/dgnc_driver.h b/drivers/staging/dgnc/dgnc_driver.h +index 218b15dccb7d..dca389ff992f 100644 +--- a/drivers/staging/dgnc/dgnc_driver.h ++++ b/drivers/staging/dgnc/dgnc_driver.h +@@ -59,6 +59,8 @@ + #define APR(args) do { PRINTF_TO_KMEM(args); printk(DRVSTR": "); printk args; \ + } while (0) + #define RAPR(args) do { PRINTF_TO_KMEM(args); printk args; } while (0) ++#define DG_NAME "dgnc-1.3-16" ++#define DG_PART "40002369_F" /* RPM part number */ + + #define TRC_TO_CONSOLE 1 + +diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211.h b/drivers/staging/rtl8187se/ieee80211/ieee80211.h +index 7f015499cfae..b835b7f02455 100644 +--- a/drivers/staging/rtl8187se/ieee80211/ieee80211.h ++++ b/drivers/staging/rtl8187se/ieee80211/ieee80211.h +@@ -1447,12 +1447,12 @@ extern void ieee80211_sta_ps_send_null_frame(struct ieee80211_device *ieee, shor + + extern const long ieee80211_wlan_frequencies[]; + +-extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee) ++static inline void ieee80211_increment_scans(struct ieee80211_device *ieee) + { + ieee->scans++; + } + +-extern inline int ieee80211_get_scans(struct ieee80211_device *ieee) ++static inline int ieee80211_get_scans(struct ieee80211_device *ieee) + { + return ieee->scans; + } +diff --git a/drivers/staging/rtl8188eu/Makefile b/drivers/staging/rtl8188eu/Makefile +index 1639a45da948..d1173ab92bea 100644 +--- a/drivers/staging/rtl8188eu/Makefile ++++ b/drivers/staging/rtl8188eu/Makefile +@@ -1,5 +1,3 @@ +-EXTRA_CFLAGS += -I$(src)/include +- + r8188eu-y := \ + core/rtw_ap.o \ + core/rtw_br_ext.o \ +@@ -67,4 +65,4 @@ r8188eu-y := \ + + obj-$(CONFIG_R8188EU) := r8188eu.o + +-ccflags-y += -D__CHECK_ENDIAN__ ++ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/include +diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h +index 05ef49f24cd9..29c3b2740ccf 100644 +--- a/drivers/staging/rtl8192e/rtllib.h ++++ b/drivers/staging/rtl8192e/rtllib.h +@@ -2761,7 +2761,6 @@ extern void rtllib_stop_scan(struct rtllib_device *ieee); + extern bool rtllib_act_scanning(struct rtllib_device *ieee, bool sync_scan); + extern void rtllib_stop_scan_syncro(struct rtllib_device *ieee); + extern void rtllib_start_scan_syncro(struct rtllib_device *ieee, u8 is_mesh); +-extern inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee); + extern u8 MgntQuery_MgntFrameTxRate(struct rtllib_device *ieee); + extern void rtllib_sta_ps_send_null_frame(struct rtllib_device *ieee, + short pwr); +@@ -2943,12 +2942,12 @@ void rtllib_softmac_scan_syncro(struct rtllib_device *ieee, u8 is_mesh); + + extern const long rtllib_wlan_frequencies[]; + +-extern inline void rtllib_increment_scans(struct rtllib_device *ieee) ++static inline void rtllib_increment_scans(struct rtllib_device *ieee) + { + ieee->scans++; + } + +-extern inline int rtllib_get_scans(struct rtllib_device *ieee) ++static inline int rtllib_get_scans(struct rtllib_device *ieee) + { + return ieee->scans; + } +diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c +index 0cbf6f5593a3..7a5be03a862e 100644 +--- a/drivers/staging/rtl8192e/rtllib_softmac.c ++++ b/drivers/staging/rtl8192e/rtllib_softmac.c +@@ -341,7 +341,7 @@ inline void softmac_ps_mgmt_xmit(struct sk_buff *skb, + } + } + +-inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee) ++static inline struct sk_buff *rtllib_probe_req(struct rtllib_device *ieee) + { + unsigned int len, rate_len; + u8 *tag; +diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h +index bc64f05a7e6a..b1a0380ee596 100644 +--- a/drivers/staging/rtl8192u/ieee80211/ieee80211.h ++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h +@@ -2250,7 +2250,7 @@ static inline void *ieee80211_priv(struct net_device *dev) + return ((struct ieee80211_device *)netdev_priv(dev))->priv; + } + +-extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) ++static inline int ieee80211_is_empty_essid(const char *essid, int essid_len) + { + /* Single white space is for Linksys APs */ + if (essid_len == 1 && essid[0] == ' ') +@@ -2266,7 +2266,7 @@ extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) + return 1; + } + +-extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode) ++static inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mode) + { + /* + * It is possible for both access points and our device to support +@@ -2292,7 +2292,7 @@ extern inline int ieee80211_is_valid_mode(struct ieee80211_device *ieee, int mod + return 0; + } + +-extern inline int ieee80211_get_hdrlen(u16 fc) ++static inline int ieee80211_get_hdrlen(u16 fc) + { + int hdrlen = IEEE80211_3ADDR_LEN; + +@@ -2578,12 +2578,12 @@ void ieee80211_softmac_scan_syncro(struct ieee80211_device *ieee); + + extern const long ieee80211_wlan_frequencies[]; + +-extern inline void ieee80211_increment_scans(struct ieee80211_device *ieee) ++static inline void ieee80211_increment_scans(struct ieee80211_device *ieee) + { + ieee->scans++; + } + +-extern inline int ieee80211_get_scans(struct ieee80211_device *ieee) ++static inline int ieee80211_get_scans(struct ieee80211_device *ieee) + { + return ieee->scans; + } +diff --git a/drivers/staging/rtl8712/ieee80211.h b/drivers/staging/rtl8712/ieee80211.h +index da4000e49da6..8269be80437a 100644 +--- a/drivers/staging/rtl8712/ieee80211.h ++++ b/drivers/staging/rtl8712/ieee80211.h +@@ -734,7 +734,7 @@ enum ieee80211_state { + #define IEEE_G (1<<2) + #define IEEE_MODE_MASK (IEEE_A|IEEE_B|IEEE_G) + +-extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) ++static inline int ieee80211_is_empty_essid(const char *essid, int essid_len) + { + /* Single white space is for Linksys APs */ + if (essid_len == 1 && essid[0] == ' ') +@@ -748,7 +748,7 @@ extern inline int ieee80211_is_empty_essid(const char *essid, int essid_len) + return 1; + } + +-extern inline int ieee80211_get_hdrlen(u16 fc) ++static inline int ieee80211_get_hdrlen(u16 fc) + { + int hdrlen = 24; + +diff --git a/drivers/staging/wlags49_h2/wl_internal.h b/drivers/staging/wlags49_h2/wl_internal.h +index 78129e93920f..1ecb5cb44bd5 100644 +--- a/drivers/staging/wlags49_h2/wl_internal.h ++++ b/drivers/staging/wlags49_h2/wl_internal.h +@@ -1013,7 +1013,7 @@ static inline void wl_unlock(struct wl_private *lp, + /* Interrupt enable disable functions */ + /********************************************************************/ + +-extern inline void wl_act_int_on(struct wl_private *lp) ++static inline void wl_act_int_on(struct wl_private *lp) + { + /* + * Only do something when the driver is handling +@@ -1025,7 +1025,7 @@ extern inline void wl_act_int_on(struct wl_private *lp) + } + } + +-extern inline void wl_act_int_off(struct wl_private *lp) ++static inline void wl_act_int_off(struct wl_private *lp) + { + /* + * Only do something when the driver is handling +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 29f28808fc03..9b90cfacf75c 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -520,6 +520,7 @@ static int pscsi_configure_device(struct se_device *dev) + " pdv_host_id: %d\n", pdv->pdv_host_id); + return -EINVAL; + } ++ pdv->pdv_lld_host = sh; + } + } else { + if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) { +@@ -602,6 +603,8 @@ static void pscsi_free_device(struct se_device *dev) + if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) && + (phv->phv_lld_host != NULL)) + scsi_host_put(phv->phv_lld_host); ++ else if (pdv->pdv_lld_host) ++ scsi_host_put(pdv->pdv_lld_host); + + if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) + scsi_device_put(sd); +diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h +index 1bd757dff8ee..820d3052b775 100644 +--- a/drivers/target/target_core_pscsi.h ++++ b/drivers/target/target_core_pscsi.h +@@ -45,6 +45,7 @@ struct pscsi_dev_virt { + int pdv_lun_id; + struct block_device *pdv_bd; + struct scsi_device *pdv_sd; ++ struct Scsi_Host *pdv_lld_host; + } ____cacheline_aligned; + + typedef enum phv_modes { +diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c +index d89e781b0a18..769bfa3a4360 100644 +--- a/drivers/thermal/step_wise.c ++++ b/drivers/thermal/step_wise.c +@@ -140,9 +140,6 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip) + old_target = instance->target; + instance->target = get_target_state(instance, trend, throttle); + +- if (old_target == instance->target) +- continue; +- + /* Activate a passive thermal instance */ + if (old_target == THERMAL_NO_TARGET && + instance->target != THERMAL_NO_TARGET) +diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c +index b4805adc50af..1dcee9a55914 100644 +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -289,7 +289,7 @@ static int xen_initial_domain_console_init(void) + return -ENOMEM; + } + +- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + info->vtermno = HVC_COOKIE; + + spin_lock(&xencons_lock); +diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c +index 96d899aee473..92f0cc442d46 100644 +--- a/drivers/usb/chipidea/debug.c ++++ b/drivers/usb/chipidea/debug.c +@@ -84,9 +84,13 @@ static ssize_t ci_port_test_write(struct file *file, const char __user *ubuf, + char buf[32]; + int ret; + +- if (copy_from_user(buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) ++ count = min_t(size_t, sizeof(buf) - 1, count); ++ if (copy_from_user(buf, ubuf, count)) + return -EFAULT; + ++ /* sscanf requires a zero terminated string */ ++ buf[count] = '\0'; ++ + if (sscanf(buf, "%u", &mode) != 1) + return -EINVAL; + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index f2121b56e681..5014a4282352 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -105,6 +105,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x04f3, 0x010c), .driver_info = + USB_QUIRK_DEVICE_QUALIFIER }, + ++ { USB_DEVICE(0x04f3, 0x0125), .driver_info = ++ USB_QUIRK_DEVICE_QUALIFIER }, ++ + { USB_DEVICE(0x04f3, 0x016f), .driver_info = + USB_QUIRK_DEVICE_QUALIFIER }, + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 8f0d6141e5e6..d702525a32b7 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -757,6 +757,7 @@ static void purge_configs_funcs(struct gadget_info *gi) + } + } + c->next_interface_id = 0; ++ memset(c->interface, 0, sizeof(c->interface)); + c->superspeed = 0; + c->highspeed = 0; + c->fullspeed = 0; +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 75dc6647ba22..07aafa50f453 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -2180,8 +2180,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td, + break; + case COMP_DEV_ERR: + case COMP_STALL: ++ frame->status = -EPROTO; ++ skip_td = true; ++ break; + case COMP_TX_ERR: + frame->status = -EPROTO; ++ if (event_trb != td->last_trb) ++ return 0; + skip_td = true; + break; + case COMP_STOP: +@@ -2789,7 +2794,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) + xhci_halt(xhci); + hw_died: + spin_unlock(&xhci->lock); +- return -ESHUTDOWN; ++ return IRQ_HANDLED; + } + + /* +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index d14b3e17b906..510e9c0efd18 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1262,7 +1262,7 @@ union xhci_trb { + * since the command ring is 64-byte aligned. + * It must also be greater than 16. + */ +-#define TRBS_PER_SEGMENT 64 ++#define TRBS_PER_SEGMENT 256 + /* Allow two commands + a link TRB, along with any reserved command TRBs */ + #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3) + #define TRB_SEGMENT_SIZE (TRBS_PER_SEGMENT*16) +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 622d349fd7da..9cb09dad969d 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -127,6 +127,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ ++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 81ab710c17ed..e47f9c642404 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -64,7 +64,6 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) }, + { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 71fd9da1d6e7..e3b7af8adfb7 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -62,10 +62,6 @@ + #define ALCATEL_VENDOR_ID 0x11f7 + #define ALCATEL_PRODUCT_ID 0x02df + +-/* Samsung I330 phone cradle */ +-#define SAMSUNG_VENDOR_ID 0x04e8 +-#define SAMSUNG_PRODUCT_ID 0x8001 +- + #define SIEMENS_VENDOR_ID 0x11f5 + #define SIEMENS_PRODUCT_ID_SX1 0x0001 + #define SIEMENS_PRODUCT_ID_X65 0x0003 +diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c +index 9910aa2edf4b..727905de0ba4 100644 +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -96,7 +96,7 @@ static struct usb_device_id id_table [] = { + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID), ++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, + { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID), + .driver_info = (kernel_ulong_t)&palm_os_4_probe }, +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 16a36b2ed902..00b47646522b 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -766,6 +766,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported by Christian Schaller <[email protected]> */ ++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000, ++ "LaCie", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_WP_DETECT ), ++ + /* Submitted by Joel Bourquard <[email protected]> + * Some versions of this device need the SubClass and Protocol overrides + * while others don't. +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index d7fddc7d10d5..2874f18313b7 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -1132,7 +1132,7 @@ tcm_vhost_send_evt(struct vhost_scsi *vs, + * lun[4-7] need to be zero according to virtio-scsi spec. + */ + evt->event.lun[0] = 0x01; +- evt->event.lun[1] = tpg->tport_tpgt & 0xFF; ++ evt->event.lun[1] = tpg->tport_tpgt; + if (lun->unpacked_lun >= 256) + evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ; + evt->event.lun[3] = lun->unpacked_lun & 0xFF; +@@ -2002,12 +2002,12 @@ tcm_vhost_make_tpg(struct se_wwn *wwn, + struct tcm_vhost_tport, tport_wwn); + + struct tcm_vhost_tpg *tpg; +- unsigned long tpgt; ++ u16 tpgt; + int ret; + + if (strstr(name, "tpgt_") != name) + return ERR_PTR(-EINVAL); +- if (kstrtoul(name + 5, 10, &tpgt) || tpgt > UINT_MAX) ++ if (kstrtou16(name + 5, 10, &tpgt) || tpgt >= VHOST_SCSI_MAX_TARGET) + return ERR_PTR(-EINVAL); + + tpg = kzalloc(sizeof(struct tcm_vhost_tpg), GFP_KERNEL); +diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c +index 4f7e1d770f81..dd8b116803d6 100644 +--- a/drivers/w1/masters/ds2490.c ++++ b/drivers/w1/masters/ds2490.c +@@ -246,7 +246,7 @@ static int ds_recv_status_nodump(struct ds_device *dev, struct ds_status *st, + memset(st, 0, sizeof(*st)); + + count = 0; +- err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_STATUS]), buf, size, &count, 100); ++ err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_STATUS]), buf, size, &count, 1000); + if (err < 0) { + printk(KERN_ERR "Failed to read 1-wire data from 0x%x: err=%d.\n", dev->ep[EP_STATUS], err); + return err; +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 4035e833ea26..767fe735abd7 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -959,7 +959,7 @@ static int find_virq(unsigned int virq, unsigned int cpu) + return rc; + } + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -973,8 +973,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu) + if (irq < 0) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1101,7 +1105,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +diff --git a/fs/aio.c b/fs/aio.c +index 7bdf3467bf24..329e6c1f3a43 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -77,6 +77,11 @@ struct kioctx_cpu { + unsigned reqs_available; + }; + ++struct ctx_rq_wait { ++ struct completion comp; ++ atomic_t count; ++}; ++ + struct kioctx { + struct percpu_ref users; + atomic_t dead; +@@ -115,7 +120,7 @@ struct kioctx { + /* + * signals when all in-flight requests are done + */ +- struct completion *requests_done; ++ struct ctx_rq_wait *rq_wait; + + struct { + /* +@@ -521,8 +526,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref) + struct kioctx *ctx = container_of(ref, struct kioctx, reqs); + + /* At this point we know that there are no any in-flight requests */ +- if (ctx->requests_done) +- complete(ctx->requests_done); ++ if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count)) ++ complete(&ctx->rq_wait->comp); + + INIT_WORK(&ctx->free_work, free_ioctx); + schedule_work(&ctx->free_work); +@@ -738,7 +743,7 @@ err: + * the rapid destruction of the kioctx. + */ + static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx, +- struct completion *requests_done) ++ struct ctx_rq_wait *wait) + { + if (!atomic_xchg(&ctx->dead, 1)) { + struct kioctx_table *table; +@@ -767,11 +772,11 @@ static void kill_ioctx(struct mm_struct *mm, struct kioctx *ctx, + if (ctx->mmap_size) + vm_munmap(ctx->mmap_base, ctx->mmap_size); + +- ctx->requests_done = requests_done; ++ ctx->rq_wait = wait; + percpu_ref_kill(&ctx->users); + } else { +- if (requests_done) +- complete(requests_done); ++ if (wait && atomic_dec_and_test(&wait->count)) ++ complete(&wait->comp); + } + } + +@@ -801,46 +806,44 @@ EXPORT_SYMBOL(wait_on_sync_kiocb); + */ + void exit_aio(struct mm_struct *mm) + { +- struct kioctx_table *table; +- struct kioctx *ctx; +- unsigned i = 0; ++ struct kioctx_table *table = rcu_dereference_raw(mm->ioctx_table); ++ struct ctx_rq_wait wait; ++ int i, skipped; + +- while (1) { +- struct completion requests_done = +- COMPLETION_INITIALIZER_ONSTACK(requests_done); +- +- rcu_read_lock(); +- table = rcu_dereference(mm->ioctx_table); ++ if (!table) ++ return; + +- do { +- if (!table || i >= table->nr) { +- rcu_read_unlock(); +- rcu_assign_pointer(mm->ioctx_table, NULL); +- if (table) +- kfree(table); +- return; +- } ++ atomic_set(&wait.count, table->nr); ++ init_completion(&wait.comp); + +- ctx = table->table[i++]; +- } while (!ctx); ++ skipped = 0; ++ for (i = 0; i < table->nr; ++i) { ++ struct kioctx *ctx = table->table[i]; + +- rcu_read_unlock(); ++ if (!ctx) { ++ skipped++; ++ continue; ++ } + + /* +- * We don't need to bother with munmap() here - +- * exit_mmap(mm) is coming and it'll unmap everything. +- * Since aio_free_ring() uses non-zero ->mmap_size +- * as indicator that it needs to unmap the area, +- * just set it to 0; aio_free_ring() is the only +- * place that uses ->mmap_size, so it's safe. ++ * We don't need to bother with munmap() here - exit_mmap(mm) ++ * is coming and it'll unmap everything. And we simply can't, ++ * this is not necessarily our ->mm. ++ * Since kill_ioctx() uses non-zero ->mmap_size as indicator ++ * that it needs to unmap the area, just set it to 0. + */ + ctx->mmap_size = 0; + +- kill_ioctx(mm, ctx, &requests_done); ++ kill_ioctx(mm, ctx, &wait); ++ } + ++ if (!atomic_sub_and_test(skipped, &wait.count)) { + /* Wait until all IO for the context are done. */ +- wait_for_completion(&requests_done); ++ wait_for_completion(&wait.comp); + } ++ ++ RCU_INIT_POINTER(mm->ioctx_table, NULL); ++ kfree(table); + } + + static void put_reqs_available(struct kioctx *ctx, unsigned nr) +@@ -1248,21 +1251,23 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx) + { + struct kioctx *ioctx = lookup_ioctx(ctx); + if (likely(NULL != ioctx)) { +- struct completion requests_done = +- COMPLETION_INITIALIZER_ONSTACK(requests_done); ++ struct ctx_rq_wait wait; ++ ++ init_completion(&wait.comp); ++ atomic_set(&wait.count, 1); + + /* Pass requests_done to kill_ioctx() where it can be set + * in a thread-safe way. If we try to set it here then we have + * a race condition if two io_destroy() called simultaneously. + */ +- kill_ioctx(current->mm, ioctx, &requests_done); ++ kill_ioctx(current->mm, ioctx, &wait); + percpu_ref_put(&ioctx->users); + + /* Wait until all IO for the context are done. Otherwise kernel + * keep using user-space buffers even if user thinks the context + * is destroyed. + */ +- wait_for_completion(&requests_done); ++ wait_for_completion(&wait.comp); + + return 0; + } +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index ec6d0de19694..d872fda15539 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -822,7 +822,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + total_size = total_mapping_size(elf_phdata, + loc->elf_ex.e_phnum); + if (!total_size) { +- error = -EINVAL; ++ retval = -EINVAL; + goto out_free_dentry; + } + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 1f096f694030..1bf0ba805ef5 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1228,6 +1228,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + + cifs_dbg(FYI, "SMB2 IOCTL\n"); + ++ *out_data = NULL; + /* zero out returned data len, in case of error */ + if (plen) + *plen = 0; +@@ -1273,11 +1274,23 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + req->Flags = 0; + + iov[0].iov_base = (char *)req; +- /* 4 for rfc1002 length field */ +- iov[0].iov_len = get_rfc1002_length(req) + 4; + +- if (indatalen) +- inc_rfc1001_len(req, indatalen); ++ /* ++ * If no input data, the size of ioctl struct in ++ * protocol spec still includes a 1 byte data buffer, ++ * but if input data passed to ioctl, we do not ++ * want to double count this, so we do not send ++ * the dummy one byte of data in iovec[0] if sending ++ * input data (in iovec[1]). We also must add 4 bytes ++ * in first iovec to allow for rfc1002 length field. ++ */ ++ ++ if (indatalen) { ++ iov[0].iov_len = get_rfc1002_length(req) + 4 - 1; ++ inc_rfc1001_len(req, indatalen - 1); ++ } else ++ iov[0].iov_len = get_rfc1002_length(req) + 4; ++ + + rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0); + rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base; +diff --git a/fs/dcache.c b/fs/dcache.c +index eb540b00d027..e619730ade4c 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1154,13 +1154,13 @@ ascend: + /* might go back up the wrong parent if we have had a rename. */ + if (need_seqretry(&rename_lock, seq)) + goto rename_retry; +- next = child->d_child.next; +- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) { ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); +- next = next->next; +- } ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } +diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c +index 3fe29de832c8..ff42208417b9 100644 +--- a/fs/ext4/ext4_jbd2.c ++++ b/fs/ext4/ext4_jbd2.c +@@ -87,6 +87,12 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) + ext4_put_nojournal(handle); + return 0; + } ++ ++ if (!handle->h_transaction) { ++ err = jbd2_journal_stop(handle); ++ return handle->h_err ? handle->h_err : err; ++ } ++ + sb = handle->h_transaction->t_journal->j_private; + err = handle->h_err; + rc = jbd2_journal_stop(handle); +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 33a676515df0..c9830686cbd5 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -361,7 +361,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) + ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); + ext4_lblk_t last = lblock + len - 1; + +- if (lblock > last) ++ if (len == 0 || lblock > last) + return 0; + return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); + } +diff --git a/fs/fhandle.c b/fs/fhandle.c +index 999ff5c3cab0..d59712dfa3e7 100644 +--- a/fs/fhandle.c ++++ b/fs/fhandle.c +@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, + goto out_err; + } + /* copy the full handle */ +- if (copy_from_user(handle, ufh, +- sizeof(struct file_handle) + ++ *handle = f_handle; ++ if (copy_from_user(&handle->f_handle, ++ &ufh->f_handle, + f_handle.handle_bytes)) { + retval = -EFAULT; + goto out_handle; +diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c +index c4166471ddf0..f6372eec78b9 100644 +--- a/fs/jbd2/recovery.c ++++ b/fs/jbd2/recovery.c +@@ -839,15 +839,23 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh, + { + jbd2_journal_revoke_header_t *header; + int offset, max; ++ int csum_size = 0; ++ __u32 rcount; + int record_len = 4; + + header = (jbd2_journal_revoke_header_t *) bh->b_data; + offset = sizeof(jbd2_journal_revoke_header_t); +- max = be32_to_cpu(header->r_count); ++ rcount = be32_to_cpu(header->r_count); + + if (!jbd2_revoke_block_csum_verify(journal, header)) + return -EINVAL; + ++ if (jbd2_journal_has_csum_v2or3(journal)) ++ csum_size = sizeof(struct jbd2_journal_revoke_tail); ++ if (rcount > journal->j_blocksize - csum_size) ++ return -EINVAL; ++ max = rcount; ++ + if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) + record_len = 8; + +diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c +index d5e95a175c92..8ecf9b92f163 100644 +--- a/fs/jbd2/revoke.c ++++ b/fs/jbd2/revoke.c +@@ -583,7 +583,7 @@ static void write_one_revoke_record(journal_t *journal, + { + int csum_size = 0; + struct buffer_head *descriptor; +- int offset; ++ int sz, offset; + journal_header_t *header; + + /* If we are already aborting, this all becomes a noop. We +@@ -600,9 +600,14 @@ static void write_one_revoke_record(journal_t *journal, + if (jbd2_journal_has_csum_v2or3(journal)) + csum_size = sizeof(struct jbd2_journal_revoke_tail); + ++ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) ++ sz = 8; ++ else ++ sz = 4; ++ + /* Make sure we have a descriptor with space left for the record */ + if (descriptor) { +- if (offset >= journal->j_blocksize - csum_size) { ++ if (offset + sz > journal->j_blocksize - csum_size) { + flush_descriptor(journal, descriptor, offset, write_op); + descriptor = NULL; + } +@@ -625,16 +630,13 @@ static void write_one_revoke_record(journal_t *journal, + *descriptorp = descriptor; + } + +- if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) { ++ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) + * ((__be64 *)(&descriptor->b_data[offset])) = + cpu_to_be64(record->blocknr); +- offset += 8; +- +- } else { ++ else + * ((__be32 *)(&descriptor->b_data[offset])) = + cpu_to_be32(record->blocknr); +- offset += 4; +- } ++ offset += sz; + + *offsetp = offset; + } +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index ab3815c856dc..775a9e1c0c45 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -551,7 +551,6 @@ int jbd2_journal_extend(handle_t *handle, int nblocks) + int result; + int wanted; + +- WARN_ON(!transaction); + if (is_handle_aborted(handle)) + return -EROFS; + journal = transaction->t_journal; +@@ -627,7 +626,6 @@ int jbd2__journal_restart(handle_t *handle, int nblocks, gfp_t gfp_mask) + tid_t tid; + int need_to_start, ret; + +- WARN_ON(!transaction); + /* If we've had an abort of any type, don't even think about + * actually doing the restart! */ + if (is_handle_aborted(handle)) +@@ -791,7 +789,6 @@ do_get_write_access(handle_t *handle, struct journal_head *jh, + int need_copy = 0; + unsigned long start_lock, time_lock; + +- WARN_ON(!transaction); + if (is_handle_aborted(handle)) + return -EROFS; + journal = transaction->t_journal; +@@ -1057,7 +1054,6 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh) + int err; + + jbd_debug(5, "journal_head %p\n", jh); +- WARN_ON(!transaction); + err = -EROFS; + if (is_handle_aborted(handle)) + goto out; +@@ -1271,7 +1267,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + struct journal_head *jh; + int ret = 0; + +- WARN_ON(!transaction); + if (is_handle_aborted(handle)) + return -EROFS; + journal = transaction->t_journal; +@@ -1407,7 +1402,6 @@ int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh) + int err = 0; + int was_modified = 0; + +- WARN_ON(!transaction); + if (is_handle_aborted(handle)) + return -EROFS; + journal = transaction->t_journal; +@@ -1538,8 +1532,22 @@ int jbd2_journal_stop(handle_t *handle) + tid_t tid; + pid_t pid; + +- if (!transaction) +- goto free_and_exit; ++ if (!transaction) { ++ /* ++ * Handle is already detached from the transaction so ++ * there is nothing to do other than decrease a refcount, ++ * or free the handle if refcount drops to zero ++ */ ++ if (--handle->h_ref > 0) { ++ jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1, ++ handle->h_ref); ++ return err; ++ } else { ++ if (handle->h_rsv_handle) ++ jbd2_free_handle(handle->h_rsv_handle); ++ goto free_and_exit; ++ } ++ } + journal = transaction->t_journal; + + J_ASSERT(journal_current_handle() == handle); +@@ -2381,7 +2389,6 @@ int jbd2_journal_file_inode(handle_t *handle, struct jbd2_inode *jinode) + transaction_t *transaction = handle->h_transaction; + journal_t *journal; + +- WARN_ON(!transaction); + if (is_handle_aborted(handle)) + return -EROFS; + journal = transaction->t_journal; +diff --git a/fs/namespace.c b/fs/namespace.c +index 247f34d43dda..185cd1aefa14 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1467,8 +1467,11 @@ struct vfsmount *collect_mounts(struct path *path) + { + struct mount *tree; + namespace_lock(); +- tree = copy_tree(real_mount(path->mnt), path->dentry, +- CL_COPY_ALL | CL_PRIVATE); ++ if (!check_mnt(real_mount(path->mnt))) ++ tree = ERR_PTR(-EINVAL); ++ else ++ tree = copy_tree(real_mount(path->mnt), path->dentry, ++ CL_COPY_ALL | CL_PRIVATE); + namespace_unlock(); + if (IS_ERR(tree)) + return ERR_CAST(tree); +diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c +index d8b0afde2179..2dba0caf1f4a 100644 +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -361,7 +361,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -370,6 +370,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) +diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h +index b521d1cd54fa..7571f433f0e3 100644 +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -186,6 +186,7 @@ + {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ +diff --git a/include/linux/libata.h b/include/linux/libata.h +index e13b3aef0b0c..b84e786ff990 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -204,6 +204,7 @@ enum { + ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */ + ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */ + ATA_LFLAG_RST_ONCE = (1 << 9), /* limit recovery to one reset */ ++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */ + + /* struct ata_port flags */ + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ +@@ -307,6 +308,12 @@ enum { + */ + ATA_TMOUT_PMP_SRST_WAIT = 5000, + ++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might ++ * be a spurious PHY event, so ignore the first PHY event that ++ * occurs within 10s after the policy change. ++ */ ++ ATA_TMOUT_SPURIOUS_PHY = 10000, ++ + /* ATA bus states */ + BUS_UNKNOWN = 0, + BUS_DMA = 1, +@@ -785,6 +792,8 @@ struct ata_link { + struct ata_eh_context eh_context; + + struct ata_device device[ATA_MAX_DEVICES]; ++ ++ unsigned long last_lpm_change; /* when last LPM change happened */ + }; + #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag) + #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0]) +@@ -1201,6 +1210,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev); + extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev); + extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap); + extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q); ++extern bool sata_lpm_ignore_phy_events(struct ata_link *link); + + extern int ata_cable_40wire(struct ata_port *ap); + extern int ata_cable_80wire(struct ata_port *ap); +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 057c1d8c77e5..5695d8a0aedb 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -528,6 +528,8 @@ + #define PCI_DEVICE_ID_AMD_15H_NB_F5 0x1605 + #define PCI_DEVICE_ID_AMD_16H_NB_F3 0x1533 + #define PCI_DEVICE_ID_AMD_16H_NB_F4 0x1534 ++#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F3 0x1583 ++#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F4 0x1584 + #define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703 + #define PCI_DEVICE_ID_AMD_LANCE 0x2000 + #define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001 +diff --git a/include/xen/events.h b/include/xen/events.h +index c9ea10ee2273..7e1a8adc41fb 100644 +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn, + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, +diff --git a/kernel/fork.c b/kernel/fork.c +index 5b486126147f..982a36db1593 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1362,10 +1362,11 @@ static struct task_struct *copy_process(unsigned long clone_flags, + goto bad_fork_cleanup_io; + + if (pid != &init_struct_pid) { +- retval = -ENOMEM; + pid = alloc_pid(p->nsproxy->pid_ns_for_children); +- if (!pid) ++ if (IS_ERR(pid)) { ++ retval = PTR_ERR(pid); + goto bad_fork_cleanup_io; ++ } + } + + p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL; +diff --git a/kernel/pid.c b/kernel/pid.c +index 82430c858d69..bbb805ccd893 100644 +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -179,7 +179,7 @@ static int alloc_pidmap(struct pid_namespace *pid_ns) + spin_unlock_irq(&pidmap_lock); + kfree(page); + if (unlikely(!map->page)) +- break; ++ return -ENOMEM; + } + if (likely(atomic_read(&map->nr_free))) { + for ( ; ; ) { +@@ -207,7 +207,7 @@ static int alloc_pidmap(struct pid_namespace *pid_ns) + } + pid = mk_pid(pid_ns, map, offset); + } +- return -1; ++ return -EAGAIN; + } + + int next_pidmap(struct pid_namespace *pid_ns, unsigned int last) +@@ -298,17 +298,20 @@ struct pid *alloc_pid(struct pid_namespace *ns) + int i, nr; + struct pid_namespace *tmp; + struct upid *upid; ++ int retval = -ENOMEM; + + pid = kmem_cache_alloc(ns->pid_cachep, GFP_KERNEL); + if (!pid) +- goto out; ++ return ERR_PTR(retval); + + tmp = ns; + pid->level = ns->level; + for (i = ns->level; i >= 0; i--) { + nr = alloc_pidmap(tmp); +- if (nr < 0) ++ if (IS_ERR_VALUE(nr)) { ++ retval = nr; + goto out_free; ++ } + + pid->numbers[i].nr = nr; + pid->numbers[i].ns = tmp; +@@ -336,7 +339,6 @@ struct pid *alloc_pid(struct pid_namespace *ns) + } + spin_unlock_irq(&pidmap_lock); + +-out: + return pid; + + out_unlock: +@@ -348,8 +350,7 @@ out_free: + free_pidmap(pid->numbers + i); + + kmem_cache_free(ns->pid_cachep, pid); +- pid = NULL; +- goto out; ++ return ERR_PTR(retval); + } + + void disable_pid_allocation(struct pid_namespace *ns) +diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c +index a28df5206d95..11649615c505 100644 +--- a/lib/strnlen_user.c ++++ b/lib/strnlen_user.c +@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count, + return res + find_zero(data) + 1 - align; + } + res += sizeof(unsigned long); +- if (unlikely(max < sizeof(unsigned long))) ++ /* We already handled 'unsigned long' bytes. Did we do it all ? */ ++ if (unlikely(max <= sizeof(unsigned long))) + break; + max -= sizeof(unsigned long); + if (unlikely(__get_user(c,(unsigned long __user *)(src+res)))) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 3650036bb910..51cd7d066e0f 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2576,7 +2576,7 @@ void mpol_free_shared_policy(struct shared_policy *p) + } + + #ifdef CONFIG_NUMA_BALANCING +-static bool __initdata numabalancing_override; ++static int __initdata numabalancing_override; + + static void __init check_numabalancing_enable(void) + { +@@ -2585,9 +2585,14 @@ static void __init check_numabalancing_enable(void) + if (IS_ENABLED(CONFIG_NUMA_BALANCING_DEFAULT_ENABLED)) + numabalancing_default = true; + +- if (nr_node_ids > 1 && !numabalancing_override) { +- printk(KERN_INFO "Enabling automatic NUMA balancing. " +- "Configure with numa_balancing= or sysctl"); ++ /* Parsed by setup_numabalancing. override == 1 enables, -1 disables */ ++ if (numabalancing_override) ++ set_numabalancing_state(numabalancing_override == 1); ++ ++ if (num_online_nodes() > 1 && !numabalancing_override) { ++ printk(KERN_INFO "%s automatic NUMA balancing. " ++ "Configure with numa_balancing= or sysctl", ++ numabalancing_default ? "Enabling" : "Disabling"); + set_numabalancing_state(numabalancing_default); + } + } +@@ -2597,13 +2602,12 @@ static int __init setup_numabalancing(char *str) + int ret = 0; + if (!str) + goto out; +- numabalancing_override = true; + + if (!strcmp(str, "enable")) { +- set_numabalancing_state(true); ++ numabalancing_override = 1; + ret = 1; + } else if (!strcmp(str, "disable")) { +- set_numabalancing_state(false); ++ numabalancing_override = -1; + ret = 1; + } + out: +diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c +index 162d6c78ad05..b11736ad2e0b 100644 +--- a/net/bridge/br_multicast.c ++++ b/net/bridge/br_multicast.c +@@ -1058,7 +1058,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br, + + err = br_ip6_multicast_add_group(br, port, &grec->grec_mca, + vid); +- if (!err) ++ if (err) + break; + } + +diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c +index 526bf56f4d31..afeb8e07ee41 100644 +--- a/net/caif/caif_socket.c ++++ b/net/caif/caif_socket.c +@@ -332,6 +332,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo) + release_sock(sk); + timeo = schedule_timeout(timeo); + lock_sock(sk); ++ ++ if (sock_flag(sk, SOCK_DEAD)) ++ break; ++ + clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + } + +@@ -376,6 +380,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + struct sk_buff *skb; + + lock_sock(sk); ++ if (sock_flag(sk, SOCK_DEAD)) { ++ err = -ECONNRESET; ++ goto unlock; ++ } + skb = skb_dequeue(&sk->sk_receive_queue); + caif_check_flow_release(sk); + +diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c +index aab733629265..2458db2966cf 100644 +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -1709,20 +1709,29 @@ static void kick_requests(struct ceph_osd_client *osdc, bool force_resend, + err = __map_request(osdc, req, + force_resend || force_resend_writes); + dout("__map_request returned %d\n", err); +- if (err == 0) +- continue; /* no change and no osd was specified */ + if (err < 0) + continue; /* hrm! */ +- if (req->r_osd == NULL) { +- dout("tid %llu maps to no valid osd\n", req->r_tid); +- needmap++; /* request a newer map */ +- continue; +- } ++ if (req->r_osd == NULL || err > 0) { ++ if (req->r_osd == NULL) { ++ dout("lingering %p tid %llu maps to no osd\n", ++ req, req->r_tid); ++ /* ++ * A homeless lingering request makes ++ * no sense, as it's job is to keep ++ * a particular OSD connection open. ++ * Request a newer map and kick the ++ * request, knowing that it won't be ++ * resent until we actually get a map ++ * that can tell us where to send it. ++ */ ++ needmap++; ++ } + +- dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid, +- req->r_osd ? req->r_osd->o_osd : -1); +- __register_request(osdc, req); +- __unregister_linger_request(osdc, req); ++ dout("kicking lingering %p tid %llu osd%d\n", req, ++ req->r_tid, req->r_osd ? req->r_osd->o_osd : -1); ++ __register_request(osdc, req); ++ __unregister_linger_request(osdc, req); ++ } + } + reset_changed_osds(osdc); + mutex_unlock(&osdc->request_mutex); +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 3663200b8dba..bd5f3461d1ce 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -921,6 +921,10 @@ static int ip_error(struct sk_buff *skb) + bool send; + int code; + ++ /* IP on this device is disabled. */ ++ if (!in_dev) ++ goto out; ++ + net = dev_net(rt->dst.dev); + if (!IN_DEV_FORWARD(in_dev)) { + switch (rt->dst.error) { +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 6ca990726d5b..268ed25f2d65 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1295,10 +1295,8 @@ csum_copy_err: + } + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 3d2758d4494e..e09ca285e8f5 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -495,10 +495,8 @@ csum_copy_err: + } + unlock_sock_fast(sk, slow); + +- if (noblock) +- return -EAGAIN; +- +- /* starting over for a new packet */ ++ /* starting over for a new packet, but check if we need to yield */ ++ cond_resched(); + msg->msg_flags &= ~MSG_TRUNC; + goto try_again; + } +diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c +index 6ee2b5863572..f21b142dee1f 100644 +--- a/net/mac80211/wep.c ++++ b/net/mac80211/wep.c +@@ -98,8 +98,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local, + + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); + +- if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN || +- skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) ++ if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN)) + return NULL; + + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -169,6 +168,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local, + size_t len; + u8 rc4key[3 + WLAN_KEY_LEN_WEP104]; + ++ if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN)) ++ return -1; ++ + iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx); + if (!iv) + return -1; +diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c +index 9e287cb56a04..7f035f0772ee 100644 +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple, + if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM]) + return -EINVAL; + ++ /* Not all fields are initialized so first zero the tuple */ ++ memset(tuple, 0, sizeof(struct nf_conntrack_tuple)); ++ + tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM])); + tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]); + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index 3f5fe03fee72..1b693a8a6957 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -804,10 +804,8 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, + if (dev->flags & IFF_UP) + dev_deactivate(dev); + +- if (new && new->ops->attach) { +- new->ops->attach(new); +- num_q = 0; +- } ++ if (new && new->ops->attach) ++ goto skip; + + for (i = 0; i < num_q; i++) { + struct netdev_queue *dev_queue = dev_ingress_queue(dev); +@@ -823,12 +821,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, + qdisc_destroy(old); + } + ++skip: + if (!ingress) { + notify_and_destroy(net, skb, n, classid, + dev->qdisc, new); + if (new && !new->ops->attach) + atomic_inc(&new->refcnt); + dev->qdisc = new ? : &noop_qdisc; ++ ++ if (new && new->ops->attach) ++ new->ops->attach(new); + } else { + notify_and_destroy(net, skb, n, classid, old, new); + } +diff --git a/net/socket.c b/net/socket.c +index 3afb43efd3e5..432b0bddd9e1 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1993,14 +1993,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, + int err, ctl_len, total_len; + + err = -EFAULT; +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + if (msg_sys->msg_iovlen > UIO_FASTIOV) { + err = -EMSGSIZE; +@@ -2205,14 +2203,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, + struct sockaddr __user *uaddr; + int __user *uaddr_len; + +- if (MSG_CMSG_COMPAT & flags) { +- if (get_compat_msghdr(msg_sys, msg_compat)) +- return -EFAULT; +- } else { ++ if (MSG_CMSG_COMPAT & flags) ++ err = get_compat_msghdr(msg_sys, msg_compat); ++ else + err = copy_msghdr_from_user(msg_sys, msg); +- if (err) +- return err; +- } ++ if (err) ++ return err; + + if (msg_sys->msg_iovlen > UIO_FASTIOV) { + err = -EMSGSIZE; +diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c +index f0f78c5f1c7d..e0062c544ac8 100644 +--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c ++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c +@@ -794,20 +794,26 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, + { + u32 value_follows; + int err; ++ struct page *scratch; ++ ++ scratch = alloc_page(GFP_KERNEL); ++ if (!scratch) ++ return -ENOMEM; ++ xdr_set_scratch_buffer(xdr, page_address(scratch), PAGE_SIZE); + + /* res->status */ + err = gssx_dec_status(xdr, &res->status); + if (err) +- return err; ++ goto out_free; + + /* res->context_handle */ + err = gssx_dec_bool(xdr, &value_follows); + if (err) +- return err; ++ goto out_free; + if (value_follows) { + err = gssx_dec_ctx(xdr, res->context_handle); + if (err) +- return err; ++ goto out_free; + } else { + res->context_handle = NULL; + } +@@ -815,11 +821,11 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, + /* res->output_token */ + err = gssx_dec_bool(xdr, &value_follows); + if (err) +- return err; ++ goto out_free; + if (value_follows) { + err = gssx_dec_buffer(xdr, res->output_token); + if (err) +- return err; ++ goto out_free; + } else { + res->output_token = NULL; + } +@@ -827,14 +833,17 @@ int gssx_dec_accept_sec_context(struct rpc_rqst *rqstp, + /* res->delegated_cred_handle */ + err = gssx_dec_bool(xdr, &value_follows); + if (err) +- return err; ++ goto out_free; + if (value_follows) { + /* we do not support upcall servers sending this data. */ +- return -EINVAL; ++ err = -EINVAL; ++ goto out_free; + } + + /* res->options */ + err = gssx_dec_option_array(xdr, &res->options); + ++out_free: ++ __free_page(scratch); + return err; + } +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index c3975bcf725f..9afa362d8a31 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1891,6 +1891,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo, + unix_state_unlock(sk); + timeo = freezable_schedule_timeout(timeo); + unix_state_lock(sk); ++ ++ if (sock_flag(sk, SOCK_DEAD)) ++ break; ++ + clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags); + } + +@@ -1955,6 +1959,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock, + struct sk_buff *skb, *last; + + unix_state_lock(sk); ++ if (sock_flag(sk, SOCK_DEAD)) { ++ err = -ECONNRESET; ++ goto unlock; ++ } + last = skb = skb_peek(&sk->sk_receive_queue); + again: + if (skb == NULL) { +diff --git a/security/lsm_audit.c b/security/lsm_audit.c +index 8d8d97dbb389..7537013d4042 100644 +--- a/security/lsm_audit.c ++++ b/security/lsm_audit.c +@@ -211,7 +211,7 @@ static inline void print_ipv4_addr(struct audit_buffer *ab, __be32 addr, + static void dump_common_audit_data(struct audit_buffer *ab, + struct common_audit_data *a) + { +- struct task_struct *tsk = current; ++ char comm[sizeof(current->comm)]; + + /* + * To keep stack sizes in check force programers to notice if they +@@ -220,8 +220,8 @@ static void dump_common_audit_data(struct audit_buffer *ab, + */ + BUILD_BUG_ON(sizeof(a->u) > sizeof(void *)*2); + +- audit_log_format(ab, " pid=%d comm=", tsk->pid); +- audit_log_untrustedstring(ab, tsk->comm); ++ audit_log_format(ab, " pid=%d comm=", current->pid); ++ audit_log_untrustedstring(ab, memcpy(comm, current->comm, sizeof(comm))); + + switch (a->type) { + case LSM_AUDIT_DATA_NONE: +@@ -276,13 +276,16 @@ static void dump_common_audit_data(struct audit_buffer *ab, + audit_log_format(ab, " ino=%lu", inode->i_ino); + break; + } +- case LSM_AUDIT_DATA_TASK: +- tsk = a->u.tsk; ++ case LSM_AUDIT_DATA_TASK: { ++ struct task_struct *tsk = a->u.tsk; + if (tsk && tsk->pid) { ++ char comm[sizeof(tsk->comm)]; + audit_log_format(ab, " pid=%d comm=", tsk->pid); +- audit_log_untrustedstring(ab, tsk->comm); ++ audit_log_untrustedstring(ab, ++ memcpy(comm, tsk->comm, sizeof(comm))); + } + break; ++ } + case LSM_AUDIT_DATA_NET: + if (a->u.net->sk) { + struct sock *sk = a->u.net->sk; +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 9baf0037866f..c036e60c34fe 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -3575,6 +3575,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = { + .patch = patch_conexant_auto }, + { .id = 0x14f150b9, .name = "CX20665", + .patch = patch_conexant_auto }, ++ { .id = 0x14f150f1, .name = "CX20721", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f2, .name = "CX20722", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f3, .name = "CX20723", ++ .patch = patch_conexant_auto }, ++ { .id = 0x14f150f4, .name = "CX20724", ++ .patch = patch_conexant_auto }, + { .id = 0x14f1510f, .name = "CX20751/2", + .patch = patch_conexant_auto }, + { .id = 0x14f15110, .name = "CX20751/2", +@@ -3609,6 +3617,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"); + MODULE_ALIAS("snd-hda-codec-id:14f150ac"); + MODULE_ALIAS("snd-hda-codec-id:14f150b8"); + MODULE_ALIAS("snd-hda-codec-id:14f150b9"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f1"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f2"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f3"); ++MODULE_ALIAS("snd-hda-codec-id:14f150f4"); + MODULE_ALIAS("snd-hda-codec-id:14f1510f"); + MODULE_ALIAS("snd-hda-codec-id:14f15110"); + MODULE_ALIAS("snd-hda-codec-id:14f15111"); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f2db52abc73a..cd621d02a093 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4142,6 +4142,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), ++ SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), +diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c +index ea141e1d6f28..310d0194268d 100644 +--- a/sound/soc/codecs/mc13783.c ++++ b/sound/soc/codecs/mc13783.c +@@ -603,14 +603,14 @@ static int mc13783_probe(struct snd_soc_codec *codec) + AUDIO_SSI_SEL, 0); + else + mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_CODEC, +- 0, AUDIO_SSI_SEL); ++ AUDIO_SSI_SEL, AUDIO_SSI_SEL); + + if (priv->dac_ssi_port == MC13783_SSI1_PORT) + mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC, + AUDIO_SSI_SEL, 0); + else + mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC, +- 0, AUDIO_SSI_SEL); ++ AUDIO_SSI_SEL, AUDIO_SSI_SEL); + + mc13xxx_unlock(priv->mc13xxx); + +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index 2a0bfb848512..edfd4edaa864 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -392,7 +392,7 @@ static const struct snd_soc_dapm_route audio_paths[] = { + { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", }, + { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */ + { "Right Input Mixer", NULL, "RINPUT2" }, +- { "Right Input Mixer", NULL, "LINPUT3" }, ++ { "Right Input Mixer", NULL, "RINPUT3" }, + + { "Left ADC", NULL, "Left Input Mixer" }, + { "Right ADC", NULL, "Right Input Mixer" }, +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index c9ce9772e49b..d495d019f18b 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2740,7 +2740,7 @@ static struct { + }; + + static int fs_ratios[] = { +- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536 ++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536 + }; + + static int bclk_divs[] = {
